Alerting

fetch alerts created by a particular user using REST API

santosh_bwn
New Member

Hi,

I am trying to fetch the alerts created by a particular user using REST APIs. How can i filter it?
Generally on UI, under alerts, there will be a yours tab which shows alerts created by me. How can i achieve similar thing using REST API(for myself or any other user).

Thanks,
Santosh

Tags (1)
0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi,

You can use below REST API to fetch particular user saved searches.

https://<your_splunk_instance>:8089/servicesNS/-/-/saved/searches?search=(eai:acl.owner="USERID")

If you want to search for particular user and from particular app then use below query

https://<your_splunk_instance>:8089/servicesNS/-/-/saved/searches?search=(eai:acl.owner="USERID") AND (eai:acl.app="App_Folder_Name")

View solution in original post

0 Karma

harsmarvania57
Ultra Champion

Hi,

You can use below REST API to fetch particular user saved searches.

https://<your_splunk_instance>:8089/servicesNS/-/-/saved/searches?search=(eai:acl.owner="USERID")

If you want to search for particular user and from particular app then use below query

https://<your_splunk_instance>:8089/servicesNS/-/-/saved/searches?search=(eai:acl.owner="USERID") AND (eai:acl.app="App_Folder_Name")
0 Karma

Sfry1981
Communicator

Hi Santosh,

When you say fetch are you looking at the REST command directly via the UI in splunk or an external tool?

0 Karma

santosh_bwn
New Member

Using external tool postman.

0 Karma

Sfry1981
Communicator

i use postman for modular input time to time with splunk but i have splunk cloud so it will be different to yours but the below should work.

Make a GET to https://:/services/alerts/alert_actions

this should bring back the whole xml you need of ll the saved searches. After this to filter you may need to write a test script to filter what you need via variables so you would have to set up a new environment to capture these variables

0 Karma

santosh_bwn
New Member

Thanks. Will check this approach

0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...