Reporting

deletion of disabled alerts and reports

Susha
Engager

Hi All,

we have lots of Alerts and reports configured in splunk which is in disabled state.. How can we find their list in excel sheet..

also how can we find all list of dashboards in splunk in one excel sheet  to review it so that we can delete the unwanted one ..

 

PLease Note:- its not about orphaned search .. that i got them  from search app dashboard ..

thanks..

Tags (2)
0 Karma

anilchaithu
Builder

@Susha 

you can use a rest search to get list of saved searches that includes all your alerts & reports. Use the below search to get the disabled alerts & reports.

| rest /servicesNS/-/-/saved/searches splunk_server="local"
| search disabled=1
| table title author eai:acl.app updated

 Similarly you can use another rest search to get all the views

| rest /servicesNS/-/-/data/ui/views splunk_server="local"
| table title author eai:acl.app updated

 

 

-- Hope this helps

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...