Could you help me create a search query which fetches Saved Searches with enabled Email Ids?

[anandhalagarasa]

We have configured around 700+ Searches and Reports (Saved searches) in our Search Head server and, for most of those, we have enabled email. We want to replace a few of the email ids which no longer exist and also we need to add additional email DLs into it.

But we aren't able to go and check each and every saved search, whether the existing email id is present or not, and its a tedious process. So, is it possible to pull a report, with the help of Search query, stating something like: if we search with the email id or DL. and it needs to show the Saved Search name, and all configured with the existing email. Then, I could go ahead and replace them quickly, which would be really helpful.

So, is it possible to fetch this information?

If yes, kindly help on the request.

[mstjohn_splunk]

Hi @anandhalagarasan,

Thanks for your post! Did you get a chance to try out @johnnyfrx 's answer? If it worked, would you go ahead and approve his answer. Also, throw him an upvote too.

If it didn't, would you mind updating us on your issue?

Happy Splunking!

[johnnyfrx]

I had a similar requirement awhile back and this search helped me out. Give it a try:

| rest /servicesNS/-/-/saved/searches search="action.email=1" | table title eai:acl.app eai:acl.owner disabled is_scheduled cron_schedule action.email*

| rest /servicesNS/-/-/saved/searches search="action.email=1" | table title action.email.to