How to find all alerts reports, and Dashboards using a specific search string

[tdavison76]

Hello, I've been asked to provide a list of all Alerts/Reports/Dashboards that contain the value "You Found a bug!"  in the underlying Search.

I have no idea how to do this :).

I manually found one Alert that is using a Search that would match:

source=bluefletch "details.package"="com.siteone.mobilepro" "details.message.environment"=PROD (event=ErrorEvent OR event=ExceptionEvent) "details.message.additionalInfo.content{}.Title"="You found a bug!"

I just need to find all of the other Alerts/Reports/Dashboards that also is using this.

Does anyone have any ideas how this can be done.  Thank you for any help on this.

Thanks,

Tom

[richgalloway · Accepted solution]

There are two REST endpoints you can use to get that information.

This one fetches saved searches (including reports and alerts)

| rest splunk_server=local /servicesNS/-/-/saved/searches
| search search="*You found a bug!*"

This one does the same for dashboards.

| rest splunk_server=local /services/-/-/data/ui/views
| search eai:data="*You found a bug!*"

[tdavison76]

Awesome, thanks for the help, much appreciated. This worked for me. 🙂

Thanks again,

Tom

[PickleRick]

Having said that - as with most of the questions starting with "how to find all" - it's possible to do it only for a specific subset of cases. There are ways of creating the searches so that you won't know what they're using effectively for searching (aliases, eventtypes, tags, subsearches, lookups...).