How to get recipients email ID and owner of email alerts in Splunk?

[knanaiah001]

Hi Team ,

Can someone help with query to get recipients email ID and owner of email alerts in splunk.

Thanks in advance!

[SanjayReddy]

Hi @knanaiah001 

please use this

| rest/servicesNS/-/-/saved/searches
| search action.email=1
| rename title as "Email Alert Name" author as "Owner of Email alert" action.email.to as "Recipients Email ID in To" action.email.cc as "Recipients Email CC" action.email.bcc as "Recipients Email BCC"
| table "Email Alert Name" "Owner of Email alert" "Recipients Email ID in To" "Recipients Email CC" "Recipients Email BCC"

[knanaiah001]

Hi @SanjayReddy  ,

Thank for quick response : ).I will check this solution
How to get to know if alert is enabled or not ?

Thanks in advance

[SanjayReddy]

Hi @knanaiah001 

by checking disabled field 

if disabled=1 means alert disabled
if disabled=0 means alert enabled 

updated the field in below query as well

| rest/servicesNS/-/-/saved/searches
| search action.email=1
| rename title as "Email Alert Name" author as "Owner of Email alert" action.email.to as "Recipients Email ID in To" action.email.cc as "Recipients Email CC" action.email.bcc as "Recipients Email BCC"
| table "Email Alert Name" "Owner of Email alert" "Recipients Email ID in To" "Recipients Email CC" "Recipients Email BCC" disabled