Alerting

how to pull a list of alerts which is having specific word?

iqbalintouch
Path Finder

Hi,

How can I pull a list or report of alerts which is having any of these specific words?
"purchase" OR "search" OR "booking"

Labels (1)
0 Karma

memarshall63
Communicator

Do you mean something like this?:

|rest /servicesNS/-/-/saved/searches 
| table title eai:acl.app eai:acl.owner actions search

So maybe with your criteria, it'd be:

|rest /servicesNS/-/-/saved/searches 
| table title eai:acl.app eai:acl.owner actions search
| where title LIKE "%Purchase%" OR title LIKE "%search%" OR title LIKE "%booking%"

Alerts generally have actions so you could add a filter for those, or there may be other ways to do it:

|rest /servicesNS/-/-/saved/searches 
| search NOT actions="" 
| table title eai:acl.app eai:acl.owner actions search 
| where title LIKE "%Purchase%" OR title LIKE "%search%" OR title LIKE "%booking%"
0 Karma

to4kawa
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk Cloud Platform 9.1.2308?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2308! Analysts can ...

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...