Splunk python SDK to find stale alerts

[RS]

By using Splunk python SDK API, is there a way to find list of all Splunk alerts which have not been triggered for specified period of time? The basic idea is to run such report on regular basis and alert users on alerts which are just sitting there for specified period of time so that those alerts can be modified etc. Thanks

[gjanders · Accepted solution]

In Alerts for Splunk Admins

or direct link to github https://github.com/gjanders/SplunkAdmins/blob/master/default/savedsearches.conf

There is an alert called "SearchHeadLevel - Alerts that have not fired an action in X days"

You could run a search like that or trigger the report or similar via the SDK/REST API. That said alerts will generally run, if they never fire an action then that might be a criteria to check if they are still valid/in use