Knowledge Management

How to use TA-webtools to disable multiple alerts/reports?

ips_mandar
Builder

HI,

I want to disable multiple alerts/reports using curl (TA-webtools)..so basically my results look like below-

title app id
report1  app1 https://abc.com:8089/servicesNS/nobody/app1/saved/searches/report1
report2  app2 https://abc.com:8089/servicesNS/nobody/app2/saved/searches/report2
report3  app3 https://abc.com:8089/servicesNS/nobody/app3/saved/searches/report3

 

How I can disable all id alert/reports in single query?

any help is appreciated!

@jkat54 

Labels (2)
Tags (1)
0 Karma
1 Solution

ips_mandar
Builder

Below is the spl how I achieved it-

...| eval url_string= id."/disable"
|map search="| curl uri=$url_string$ method=POST splunkauth=true"

View solution in original post

0 Karma

ips_mandar
Builder

Below is the spl how I achieved it-

...| eval url_string= id."/disable"
|map search="| curl uri=$url_string$ method=POST splunkauth=true"
0 Karma

ips_mandar
Builder

Thanks @jkat54 I was able to do using map command

0 Karma

jkat54
SplunkTrust
SplunkTrust

You could do this using the urifield option and eval.  Here's an example below:

 

no reason you can't do something like

| makeresults count=3
| streamstats count 

| eval uri="https://abc.com:8089/app".count."/report".count"

 

 

Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...