How can I write a search that will list all the saved reports in my splunk environment?

[saikatr]

I need to write search queries to list all the dashboards and reports saved in my splunk environment. I was able to list the dashboards by using

| rest /servicesNS/-/-/data/ui/views | search isDashboard=1 | search eai:acl.app=search |

but I am unable to write a query for the latter.

i thought | rest /servicesNS/-/-/data/ui/views | would at least list all the reports (among other views) and i would be able to filter the rest out. Unfortunately, this isn't even listing all the reports available to me.

I am a new user and any help is greatly appreciated.

[MuS · Accepted solution]

Hi saikatr,

how about using this REST endpoint:

| rest /services/saved/searches

cheers, MuS

[saikatr]

Thanks MuS,

This clearly sets me on the right path, This gave me a nice mix of reports and alerts:

| rest /services/saved/searches/ | search is_visible=1 | fields title is_scheduled is_visible eai:acl.perms.write eai:acl.sharing

Would you by any chance be able to test this query and inform what might be the critical step to be able to list the reports and alerts separately?

[astackpole]

Did you ever get this resolved?

I see this is an old comment but am trying to accomplish the same thing now as well (list reports and alerts in separate dashboard panels).

[dwraesner]

Hello,

This is definitely an old post, but can anyone share how they have created a search to accurately list whether a saved search is either a report or an alert.

This list exists under the menu item Searches, Reports & Alerts as the column Type lists whether it's a report or an alert, but the code underneath doesn't seem to be viewable like selecting a panel in a dashboard will show the underlying SPL.

Also that report from Searches, Reports & Alerts which shows the Type doesn't seem to be exportable.

[isoutamo]

Hi

here is my old answer https://community.splunk.com/t5/Monitoring-Splunk/How-do-I-export-all-alerts-to-csv-or-pdf/m-p/62922...

r. Ismo