Hi,
I want to have list of all saved realtime searches and alerts as my dispatch is filling up every now and then. I want to contact the owner of the scheduled result so I want to have owners name also.
Thanks,
Hello @Amandeepsin,
please try the following :
| rest /services/saved/searches | table next_scheduled_time, eai:acl.owner
The next_scheduled_time info will let you know when the search will be scheduled next, and eai:acl.owner will let you know the user name. The rest command returns a lot of fields. Some of them may also help you.
More info about the rest command can be found in: https://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/Rest