Splunk Search

Need splunk query to get alerts/saved searches/dashboards created by each index

srinivasup
Explorer

Can anyone help me to get all saved searches/alerts configured using particular index .

Tags (1)
0 Karma

woodcock
Esteemed Legend

This will do it BUT there is a problem:

| rest /servicesNS/-/-/saved/searches 
| table search title
| rex max_match=0 field=search "(?<=^|\s|\[)index\s*=\s*(?<index>(?:\"[^\"]+\")|\S+)" 
| rex field=index mode=sed "s/\"//g"
| fillnull value="N/A" index
| stats values(title) BY index

The problem is that it does not handle any cases where index is not specified literally inside the search string. These cases include: |savedsearch, |loadjob, eventtypes, macros tags, the use of Indexes searched by default (which may vary depending on user and role) and probably other things that I am missing. Also note that values (and limit) are limited to a maximum of 1000 values.

0 Karma

srinivasup
Explorer

Its not giving expected results.

Would like to search for one index and for this index would like to know alerts, saved searches configured by using this index.

0 Karma

woodcock
Esteemed Legend

You are right; I only did half the work; see the updated answer.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...