splunk: View the alerts created by another user

Path Finder

We are using splunk enterprise in our organization. Is it possible to view the alerts created by another user?

I went to

Reports and Dashboards -> Alerts

Clicked on All. Searched for the other user's name in the searchbox but no results come up.

Thanks for reading.alt text

Tags (2)
0 Karma

Esteemed Legend

Try this:

|rest/servicesNS/-/-/saved/searches splunk_server=local
| where 'alert.track'="1" AND ('eai:acl.owner' = "sumguy" OR owner = "sumguy")
| dedup id
| rename dispatch.* AS *
| rename eai:acl.* AS *
| table owner sharing title search description* *
| sort 0 title

And, just in case somebody comes here expecting alert to mean something else, here is that answer, too:

| rest /servicesNS/-/-/alerts/fired_alerts/- splunk_server=local
| addinfo
| where trigger_time >= info_min_time
| table trigger_time author eai:acl.owner savedsearch_name sid eai:acl.sharing digest_mode id published *
| rename eai:acl.* AS *
| search author="sumguy" OR owner="sumguy"
0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...