How can I get the list of saved realtime searches and alerts as my disptach is filling up every now and then

[Amandeepsin]

Hi,

I want to have list of all saved realtime searches and alerts as my dispatch is filling up every now and then. I want to contact the owner of the scheduled result so I want to have owners name also.

Thanks,

[poete]

Hello @Amandeepsin,

please try the following :

| rest /services/saved/searches | table next_scheduled_time, eai:acl.owner

The next_scheduled_time info will let you know when the search will be scheduled next, and eai:acl.owner will let you know the user name. The rest command returns a lot of fields. Some of them may also help you.
More info about the rest command can be found in: https://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/Rest