Reporting
Highlighted

search all saved searches .conf files

Contributor

quick question, I want to search all saved searches .conf files for all email actions for a specific e-mail address while also showing the search name, how would i do this?

0 Karma
Highlighted

Re: search all saved searches .conf files

SplunkTrust
SplunkTrust

Try this

| rest /servicesNS/-/-/saved/searches/ | where is_scheduled=1 AND 'action.email'=1 | table eai:acl.app title

0 Karma
Highlighted

Re: search all saved searches .conf files

Contributor

seems like it is not showing all the alerts in the saved searches .conf file. and it is not showing the e-mail actions.

0 Karma
Highlighted

Re: search all saved searches .conf files

Ultra Champion

On the file system something like - find . -name "searches.conf" | xargs grep -i <e-mail address>

Highlighted

Re: search all saved searches .conf files

Influencer

Use the GUI. Searches and Reports will show you matches for email addresses within scheduled searches.

Or on the CLI, you could use btool and some grep'ing:

splunk btool savedsearches list | egrep -r "^\[|youremailaddress@email.com"

This will show you each saved search stanza opening, followed by a line with the matching email if it's there.

Highlighted

Re: search all saved searches .conf files

Contributor

i want it to show the search/alert name and who it e-mails. i am getting verbose results with this one.

0 Karma
Highlighted

Re: search all saved searches .conf files

Influencer

Right. It shows all scheduled search names, but only those with emails will have a second line:

[somesearch]
action.email.to = youremail@email.com
[another_search]
[yetanother]
0 Karma
Highlighted

Re: search all saved searches .conf files

Motivator

Windows command line:

findstr /s /i "<search_string>" savedsearches.conf

Unix/Linux command line:

find . -name savedsearches.conf -exec grep -i "<search_string>" {} \;

View solution in original post

Highlighted

Re: search all saved searches .conf files

SplunkTrust
SplunkTrust

Try like this (to list all)

| rest /servicesNS/-/-/saved/searches splunk_server=local  | search action.email=1 | table title eai:acl.app action.email.to

For searches for specific email

| rest /servicesNS/-/-/saved/searches splunk_server=local  | search action.email=1 action.email.to=*emailtosearch@example.com* | table title eai:acl.app action.email.to