Can anyone help me to get all saved searches/alerts configured using particular index .
This will do it BUT there is a problem:
| rest /servicesNS/-/-/saved/searches | table search title | rex max_match=0 field=search "(?<=^|\s|\[)index\s*=\s*(?<index>(?:\"[^\"]+\")|\S+)" | rex field=index mode=sed "s/\"//g" | fillnull value="N/A" index | stats values(title) BY index
The problem is that it does not handle any cases where
index is not specified literally inside the search string. These cases include:
tags, the use of
Indexes searched by default (which may vary depending on
role) and probably other things that I am missing. Also note that
limit) are limited to a maximum of 1000 values.