Splunk Enterprise

Need help with preparing a list of Middleware reports on the Ent. + write an alert to be notified when they are changed.

SamHTexas
Builder

I need help with writing an SPL to list all the Middleware reports on the Splunk Ent. & An alert to email me when any report is changed please. Thank very much.

Labels (1)
Tags (1)
0 Karma

SinghK
Builder

All reports are saved searches 

|rest /servicesNS/-/-/saved/searches|table title, updated 

 

the spl query above will give you all the searches on your splunk instance and when they are updated. you will need to filter out your searches and setup and alert.

you can also add field "author" this way it will let you catch the person who changed it. 

inventsekar
SplunkTrust
SplunkTrust

Hi @SamHTexas .. we will need more details from your side..

 list all the Middleware reports  are they created by a same person / same app / same team? we got some rest api's that will list down all reports..

 

Once we created the SPL query to list down all middleware reports, its easy to create email alert. 

hope you got the idea, thanks. 

0 Karma

SamHTexas
Builder

Would you please share an SPL that would make a list of the only the middleware reports. Thanks a million

Tags (1)
0 Karma

SamHTexas
Builder

Thank u very much for your reply. Would you share a SPL I can use in GUI for all & one for 2 Teams that create the middleware reports. I really appreciate your help. Thx

Tags (1)
0 Karma

SinghK
Builder

Sam, 

 

this is the query

|rest /servicesNS/-/-/saved/searches|table title, updated, author. run that in search and you will get results.

SamHTexas
Builder

Thanks very much. Would this work on the Splunk Ent. as well as the ES? 

Tags (1)
0 Karma

SinghK
Builder

Yes.

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...