Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Alerting
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Alerting
- :
- Re: how to get list of alerts which are disabled w...
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
chandanjaisal
Explorer
07-09-2015
02:50 AM
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
woodcock
Esteemed Legend
07-09-2015
05:54 AM
You get the list of alerts like this:
|rest/servicesNS/admin/search/saved/searches | search disabled=1 | table title | outputlookup mylookup
You run this as a saved search every 24-hours and use outputlookup to save the results. You also save a similar search to run just before the first one that uses inputlookup and compares the 2 looking for new entries and ignoring old entries like this:
|rest/servicesNS/admin/search/saved/searches | search disabled=1 | table title | eval type="new" | append [|inputlookup mylookup | eval type="old]" | stats values(type) AS types BY title | where types!="old"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
woodcock
Esteemed Legend
07-09-2015
05:54 AM
You get the list of alerts like this:
|rest/servicesNS/admin/search/saved/searches | search disabled=1 | table title | outputlookup mylookup
You run this as a saved search every 24-hours and use outputlookup to save the results. You also save a similar search to run just before the first one that uses inputlookup and compares the 2 looking for new entries and ignoring old entries like this:
|rest/servicesNS/admin/search/saved/searches | search disabled=1 | table title | eval type="new" | append [|inputlookup mylookup | eval type="old]" | stats values(type) AS types BY title | where types!="old"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
chandanjaisal
Explorer
08-24-2015
10:03 AM
Hi Woodcock
Can we merge these two search
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
woodcock
Esteemed Legend
08-24-2015
10:37 AM
Possibly but I think it would be highly inadvisable.
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!
Tech Talk Recap | Mastering Threat Hunting
Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...
Observability for AI Applications: Troubleshooting Latency
If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...
Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?
In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...
