Reporting

deletion of disabled alerts and reports

Susha
Engager

Hi All,

we have lots of Alerts and reports configured in splunk which is in disabled state.. How can we find their list in excel sheet..

also how can we find all list of dashboards in splunk in one excel sheet  to review it so that we can delete the unwanted one ..

 

PLease Note:- its not about orphaned search .. that i got them  from search app dashboard ..

thanks..

Tags (2)
0 Karma

anilchaithu
Builder

@Susha 

you can use a rest search to get list of saved searches that includes all your alerts & reports. Use the below search to get the disabled alerts & reports.

| rest /servicesNS/-/-/saved/searches splunk_server="local"
| search disabled=1
| table title author eai:acl.app updated

 Similarly you can use another rest search to get all the views

| rest /servicesNS/-/-/data/ui/views splunk_server="local"
| table title author eai:acl.app updated

 

 

-- Hope this helps

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...