I wasn't able to get Incident Setting to display any alerts after setting the script to alert_handler.py, and had a look at the search.
What you're doing is this:
| rest /servicesNS/nobody/$app$/saved/searches/.. [snip]
Why not do this instead? Gets you out of having to worry about app context and owner altogether... not all alerts are owned by 'nobody'. For instance, in SA-nix, they're owned by admin (on my installation anyway)
| rest /servicesNS/-/-/saved/searches/ ... [snip]
Just a thought
cmeo
Hi cmeo
Thanks a lot for your suggestion. Honestly, I haven't been aware it was possible to run a rest call without adding an app or user.
The enhancement has been committed and will be released soon, together with the 2.0 release.
Thanks
Simon
Thanks for the suggestion. Will be fixed in the upcoming release.