Alerting

splunk: View the alerts created by another user

Path Finder

We are using splunk enterprise in our organization. Is it possible to view the alerts created by another user?

I went to

Reports and Dashboards -> Alerts

Clicked on All. Searched for the other user's name in the searchbox but no results come up.

Thanks for reading.alt text

Tags (2)
0 Karma

Esteemed Legend

Try this:

|rest/servicesNS/-/-/saved/searches splunk_server=local
| where 'alert.track'="1" AND ('eai:acl.owner' = "sumguy" OR owner = "sumguy")
| dedup id
| rename dispatch.* AS *
| rename eai:acl.* AS *
| table owner sharing title search description* *
| sort 0 title

And, just in case somebody comes here expecting alert to mean something else, here is that answer, too:

| rest /servicesNS/-/-/alerts/fired_alerts/- splunk_server=local
| addinfo
| where trigger_time >= info_min_time
| table trigger_time author eai:acl.owner eai:acl.app savedsearch_name sid eai:acl.sharing digest_mode id published *
| rename eai:acl.* AS *
| search author="sumguy" OR owner="sumguy"
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!