Getting Data In

Delete fired-alerts via endpoint?

rroberts
Splunk Employee
Splunk Employee

I can list fired-alerts via endpoint https://localhost:8089/servicesNS/admin/search/alerts/fired_alerts/-
There is a way to delete fired-alerts via API?

Tags (2)
1 Solution

rroberts
Splunk Employee
Splunk Employee

Found snippet example using Python internal SDK:

Fired_alert.py

Provides object mapping for fired alerts objects

Example use case:

sessionKey = splunk.auth.getSessionKey('admin','changeme')

s = SavedSearch.get('/servicesNS/admin/search/admin/savedsearch/someAlert')
alerts = s.get_alerts()

# print them all
for a in alerts:

print a.severity, str(a.trigger_time), str(action)

#now delete the most recent one

alerts[0].delete()

View solution in original post

mzorzi
Splunk Employee
Splunk Employee

rroberts
Splunk Employee
Splunk Employee

Found snippet example using Python internal SDK:

Fired_alert.py

Provides object mapping for fired alerts objects

Example use case:

sessionKey = splunk.auth.getSessionKey('admin','changeme')

s = SavedSearch.get('/servicesNS/admin/search/admin/savedsearch/someAlert')
alerts = s.get_alerts()

# print them all
for a in alerts:

print a.severity, str(a.trigger_time), str(action)

#now delete the most recent one

alerts[0].delete()

sbsbb
Builder

Hi Robert, could you post your entire code here ?

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...