Alerting

fetch alerts created by a particular user using REST API

santosh_bwn
New Member

Hi,

I am trying to fetch the alerts created by a particular user using REST APIs. How can i filter it?
Generally on UI, under alerts, there will be a yours tab which shows alerts created by me. How can i achieve similar thing using REST API(for myself or any other user).

Thanks,
Santosh

Tags (1)
0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi,

You can use below REST API to fetch particular user saved searches.

https://<your_splunk_instance>:8089/servicesNS/-/-/saved/searches?search=(eai:acl.owner="USERID")

If you want to search for particular user and from particular app then use below query

https://<your_splunk_instance>:8089/servicesNS/-/-/saved/searches?search=(eai:acl.owner="USERID") AND (eai:acl.app="App_Folder_Name")

View solution in original post

0 Karma

harsmarvania57
Ultra Champion

Hi,

You can use below REST API to fetch particular user saved searches.

https://<your_splunk_instance>:8089/servicesNS/-/-/saved/searches?search=(eai:acl.owner="USERID")

If you want to search for particular user and from particular app then use below query

https://<your_splunk_instance>:8089/servicesNS/-/-/saved/searches?search=(eai:acl.owner="USERID") AND (eai:acl.app="App_Folder_Name")
0 Karma

Sfry1981
Communicator

Hi Santosh,

When you say fetch are you looking at the REST command directly via the UI in splunk or an external tool?

0 Karma

santosh_bwn
New Member

Using external tool postman.

0 Karma

Sfry1981
Communicator

i use postman for modular input time to time with splunk but i have splunk cloud so it will be different to yours but the below should work.

Make a GET to https://:/services/alerts/alert_actions

this should bring back the whole xml you need of ll the saved searches. After this to filter you may need to write a test script to filter what you need via variables so you would have to set up a new environment to capture these variables

0 Karma

santosh_bwn
New Member

Thanks. Will check this approach

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...