- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How do I view / save the entire list of Reports + Alerts in Splunk Enterprise , any SPLs is much appreciated. Thank u
SamHTexas
Builder
08-26-2021
09:31 AM
How do I view / save the entire list of Reports + Alerts in Splunk Enterprise, any SPLs is much appreciated.
If you would show me how to generate the same for ES. Thank u
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

richgalloway

SplunkTrust
08-27-2021
09:34 AM
Start with this REST command then customize the query to produce the desired output.
| rest /servicesNS/-/-/saved/searches
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
SamHTexas
Builder
08-27-2021
10:47 AM
Thank u for your reply. I am not clear. I ran:
| rest /servicesNS/-/-/saved/searches
Received general search results
Ran
| rest /servicesNS/-/-/saved/reports No results
| rest /servicesNS/-/-/saved/alerts No results
I am sure I have many reports & alerts. I appreciate a reply. Thank u as always Rich.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

richgalloway

SplunkTrust
08-27-2021
11:37 AM
Reports and alerts are just saved searches so the one REST command will return them all. For reports, the alert_type field value will be "always".
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
