Splunk Search

Need splunk query to get alerts/saved searches/dashboards created by each index

srinivasup
Explorer

Can anyone help me to get all saved searches/alerts configured using particular index .

Tags (1)
0 Karma

woodcock
Esteemed Legend

This will do it BUT there is a problem:

| rest /servicesNS/-/-/saved/searches 
| table search title
| rex max_match=0 field=search "(?<=^|\s|\[)index\s*=\s*(?<index>(?:\"[^\"]+\")|\S+)" 
| rex field=index mode=sed "s/\"//g"
| fillnull value="N/A" index
| stats values(title) BY index

The problem is that it does not handle any cases where index is not specified literally inside the search string. These cases include: |savedsearch, |loadjob, eventtypes, macros tags, the use of Indexes searched by default (which may vary depending on user and role) and probably other things that I am missing. Also note that values (and limit) are limited to a maximum of 1000 values.

0 Karma

srinivasup
Explorer

Its not giving expected results.

Would like to search for one index and for this index would like to know alerts, saved searches configured by using this index.

0 Karma

woodcock
Esteemed Legend

You are right; I only did half the work; see the updated answer.

0 Karma
Get Updates on the Splunk Community!

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

&#x1f5e3; You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...

Splunk New Course Releases for a Changing World

Every day, the world feels like it’s moving faster with new technological breakthroughs, AI innovation, and ...

Insights from .conf 2025, Smart Edge Processor Scaling, and a New Splunk Lantern ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...