Can anyone help me to get all saved searches/alerts configured using particular index .
This will do it BUT there is a problem:
| rest /servicesNS/-/-/saved/searches
| table search title
| rex max_match=0 field=search "(?<=^|\s|\[)index\s*=\s*(?<index>(?:\"[^\"]+\")|\S+)"
| rex field=index mode=sed "s/\"//g"
| fillnull value="N/A" index
| stats values(title) BY index
The problem is that it does not handle any cases where index
is not specified literally inside the search string. These cases include: |savedsearch
, |loadjob
, eventtypes
, macros
tags
, the use of Indexes searched by default
(which may vary depending on user
and role
) and probably other things that I am missing. Also note that values
(and limit
) are limited to a maximum of 1000 values.
Its not giving expected results.
Would like to search for one index and for this index would like to know alerts, saved searches configured by using this index.
You are right; I only did half the work; see the updated answer.