Get list of reports and alerts using Splunk SDK

[rajeshad]

How can I use Splunk SDK/Rest API to get list of alerts and reports? For example, the page below shows total of 269 alerts. Would like to access these alerts with all its metadata (such as the underlying query).

Thanks!

[richgalloway · Accepted solution]

Get a list of reports with this REST command

| rest /servicesNS/-/-/saved/searches splunk_server=local 
| search alert_type="always" 

Use this REST command to get a list of alerts

| rest /servicesNS/-/-/saved/searches splunk_server=local 
| search alert_type!="always"

[rajeshad]

The query is not listing any events and the data is only available on Statistics tab. Is this expected or am I missing something?

[richgalloway]

Yes, that is normal.  The rest command does not search for events - it returns information.

[rajeshad]

Thank you, will try it out!