Reporting

deletion of disabled alerts and reports

Susha
Engager

Hi All,

we have lots of Alerts and reports configured in splunk which is in disabled state.. How can we find their list in excel sheet..

also how can we find all list of dashboards in splunk in one excel sheet  to review it so that we can delete the unwanted one ..

 

PLease Note:- its not about orphaned search .. that i got them  from search app dashboard ..

thanks..

Tags (2)
0 Karma

anilchaithu
Builder

@Susha 

you can use a rest search to get list of saved searches that includes all your alerts & reports. Use the below search to get the disabled alerts & reports.

| rest /servicesNS/-/-/saved/searches splunk_server="local"
| search disabled=1
| table title author eai:acl.app updated

 Similarly you can use another rest search to get all the views

| rest /servicesNS/-/-/data/ui/views splunk_server="local"
| table title author eai:acl.app updated

 

 

-- Hope this helps

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...