Alerting

fetch alerts created by a particular user using REST API

santosh_bwn
New Member

Hi,

I am trying to fetch the alerts created by a particular user using REST APIs. How can i filter it?
Generally on UI, under alerts, there will be a yours tab which shows alerts created by me. How can i achieve similar thing using REST API(for myself or any other user).

Thanks,
Santosh

Labels (1)
Tags (1)
0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi,

You can use below REST API to fetch particular user saved searches.

https://<your_splunk_instance>:8089/servicesNS/-/-/saved/searches?search=(eai:acl.owner="USERID")

If you want to search for particular user and from particular app then use below query

https://<your_splunk_instance>:8089/servicesNS/-/-/saved/searches?search=(eai:acl.owner="USERID") AND (eai:acl.app="App_Folder_Name")

View solution in original post

0 Karma

harsmarvania57
Ultra Champion

Hi,

You can use below REST API to fetch particular user saved searches.

https://<your_splunk_instance>:8089/servicesNS/-/-/saved/searches?search=(eai:acl.owner="USERID")

If you want to search for particular user and from particular app then use below query

https://<your_splunk_instance>:8089/servicesNS/-/-/saved/searches?search=(eai:acl.owner="USERID") AND (eai:acl.app="App_Folder_Name")
0 Karma

Sfry1981
Communicator

Hi Santosh,

When you say fetch are you looking at the REST command directly via the UI in splunk or an external tool?

0 Karma

santosh_bwn
New Member

Using external tool postman.

0 Karma

Sfry1981
Communicator

i use postman for modular input time to time with splunk but i have splunk cloud so it will be different to yours but the below should work.

Make a GET to https://:/services/alerts/alert_actions

this should bring back the whole xml you need of ll the saved searches. After this to filter you may need to write a test script to filter what you need via variables so you would have to set up a new environment to capture these variables

0 Karma

santosh_bwn
New Member

Thanks. Will check this approach

0 Karma
Get Updates on the Splunk Community!

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...

Stay Connected: Your Guide to February Tech Talks, Office Hours, and Webinars!

&#x1f48c;Keep the new year’s momentum going with our February lineup of Community Office Hours, Tech Talks, ...