deletion of disabled alerts and reports

[Susha]

Hi All,

we have lots of Alerts and reports configured in splunk which is in disabled state.. How can we find their list in excel sheet..

also how can we find all list of dashboards in splunk in one excel sheet  to review it so that we can delete the unwanted one ..

PLease Note:- its not about orphaned search .. that i got them  from search app dashboard ..

thanks..

[anilchaithu]

@Susha 

you can use a rest search to get list of saved searches that includes all your alerts & reports. Use the below search to get the disabled alerts & reports.

| rest /servicesNS/-/-/saved/searches splunk_server="local"
| search disabled=1
| table title author eai:acl.app updated

 Similarly you can use another rest search to get all the views

| rest /servicesNS/-/-/data/ui/views splunk_server="local"
| table title author eai:acl.app updated

-- Hope this helps