fetch alerts created by a particular user using REST API

[santosh_bwn]

Hi,

I am trying to fetch the alerts created by a particular user using REST APIs. How can i filter it?
Generally on UI, under alerts, there will be a yours tab which shows alerts created by me. How can i achieve similar thing using REST API(for myself or any other user).

Thanks,
Santosh

[harsmarvania57 · Accepted solution]

Hi,

You can use below REST API to fetch particular user saved searches.

https://<your_splunk_instance>:8089/servicesNS/-/-/saved/searches?search=(eai:acl.owner="USERID")

If you want to search for particular user and from particular app then use below query

https://<your_splunk_instance>:8089/servicesNS/-/-/saved/searches?search=(eai:acl.owner="USERID") AND (eai:acl.app="App_Folder_Name")

[Sfry1981]

Hi Santosh,

When you say fetch are you looking at the REST command directly via the UI in splunk or an external tool?

[santosh_bwn]

Using external tool postman.

[Sfry1981]

i use postman for modular input time to time with splunk but i have splunk cloud so it will be different to yours but the below should work.

Make a GET to https://:/services/alerts/alert_actions

this should bring back the whole xml you need of ll the saved searches. After this to filter you may need to write a test script to filter what you need via variables so you would have to set up a new environment to capture these variables

[santosh_bwn]

Thanks. Will check this approach