Security

How can I export alerts with names matching a specific phrase ( say "oscar")?

ytaointra
New Member

How can I export alerts with names matching a specific phrase ( say "oscar"). And the report needs to include all the details of each alert settings, include search, schedule, etc.

Thanks

Tags (1)
0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

Try this

| rest splunk_server=local /servicesNS/-/-/saved/searches 
| table title eai:acl.app search eai:acl.owner cron_schedule
| rename eai:acl.owner as owner 
| search search=*oscar*

View solution in original post

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try this

| rest splunk_server=local /servicesNS/-/-/saved/searches 
| table title eai:acl.app search eai:acl.owner cron_schedule
| rename eai:acl.owner as owner 
| search search=*oscar*
0 Karma

ytaointra
New Member

Thank you very much! How can I include schedule for each alert in the report? Thanks.

0 Karma

ytaointra
New Member

Thank you so much! How can I also include the time range? I tried "time_range", "earliest", "latest", but didn't work.
Thank you.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Need to strip off line 2 and look at all the fields available. I think you're probably looking for timespan. I've answered your original question. Can you please accept/upvote?

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Please upvote and accept if this helped you.

I have edited my original answer to include the cron expression

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...