Which alerts reference a specific index?

[jlkitz]

Hi,

I am trying to determine how to see what alerts are using specific indexes in Splunk?  Is there a way to search that? So if I wanted to see all alerts that are using index=firewall, for example, how would I get that?

[PickleRick]

Consult your environment's documentation.

But seriously - an alert is just a scheduled search. You can't automatically determine which indexes will be used when the search is run. Yes, you can do a search for some common ways of specifying the index (most importantly the literal "index=something" string) but as you think of more ways of specifying the index to search it gets more and more impossible.

Apart from simple "index=something" way you can do:

1) index IN (some set)

2) use an alias which will expand to a set of parameters (including index(es))

3) place a condition on eventtype which can resolve to a condition for index(es)

4) use a subsearch which will dynamically create a index=something parameter (theoretically you can even choose index randomly this way).

So you can see that in general case there is no way to reliably determine before running the search which indexes will be searched.