Splunk Search

How to find all alerts with a specific alert action?

TylerJVitale
Explorer

I'm trying to find all the saved alerts that have a certain action. I've found this search:

|rest/servicesNS/-/-/saved/searches | search alert.track=1 actions="*action*" | fields title description search disabled triggered_alert_count actions

 

However, this only returns some of the alerts with that action, and I'm not sure why. It looks like any alert that has other actions that are alphabetically before "action" are in the results, but any alert that has other actions alphabetically after "action" are not returned.

 

Any assistance would be much appreciated.

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...