Splunk Alerts with no alert actions

[python]

Hi,

How can i query Alerts without alert actions and i want to see also the status. 

[python]

how about alerts with no triggered actions?

[python]

Thanks a lot. 

[richgalloway]

You can query all alerts using this REST command.  Filter the results to find the information you seek.

| rest splunk_server=local /servicesNS/-/-/saved/searches
| search alert_type!="always"

[python]

how about alerts with no triggered actions?

[richgalloway]

To find alerts that have not triggered, try this query

| rest /servicesNS/-/-/saved/searches splunk_server=local
| fields title disabled triggered_alert_count alert.severity alert.track eai:acl.app
| rename alert.track as isAlert, eai:acl.app as App
| eval TriggerCount=coalesce(triggered_alert_count, 0)
| where disabled=0 AND TriggerCount=0 AND isAlert=1
| table title alert.severity App