How to list duplicate alerts

[zawan]

I am trying to optimize my splunk deployment by removing duplicate alerts.

I have this search which shows me all of the alerts and the actual searches but I want to narrow it down to only show events with a duplicate name or search so that I can remove them.

| rest /servicesNS/-/-/saved/searches/ splunk_server=local 
| search is_scheduled=1 
| fields title search
| rename title AS savedsearch_name 
| table savedsearch_name search

[richgalloway · Accepted solution]

This search will get you duplicate searches. You should be able to modify it to get duplicate names, although I'm not sure that's very useful.

| rest /servicesNS/-/-/saved/searches/ splunk_server=local 
| search is_scheduled=1 
| fields eai:acl.app title search | stats values(eai:acl.app) as app, values(title) as title, count by search | where count > 1

Keep in mind it's possible to have duplicate alerts where the search strings don't match as there is more than one way to accomplish the same task in SPL.