how many splunk alerts are send to single User for an Application?

[pratibha0610]

Hi Team,

So i am new to splunk, therefore excuses for my stupid question.

We have an Application, and multiple alerts/reports are created under it. Now there is a situation where a user fro our team is moved to another one, so i have to get list of alerts/report that are send this user. Can i do it with a search or manually is only option.

Thanks in advance!!

[richgalloway · Accepted solution]

You can use the rest command in a search to find alerts and reports going to a particular email address.

|rest splunk_server=local /servicesNS/-/-/saved/searches 
| search action.email.to="foo@bar.com"
| table eai:acl.app title action.email.to