Questions on query to get all alerts which are configured in Splunk , 1 , 0 , and Blanks in the fields

[Cheng2Ready]

So jumping into this search  question
https://community.splunk.com/t5/Alerting/How-can-I-query-to-get-all-alerts-which-are-configured/m-p/...

my search I am using:
| rest /servicesNS/-/-/saved/searches splunk_server=local
| search disabled=0
|table title, disabled, action.hangout_chat_alert, action.email

I came a across the question of there is any documentation on what the 1, 0 or Blank means? on some of the fields .
I have this alert that only has HangoutChat alert setup
when I run this query below It shows

title
disabled=0 
action.hangout_chat_alert=0
and action.email=0

I'm confused as to why email and hangout are returning the value 0
shouldn't it be like. disabled = 0 is returning me all alerts that are active and 1 is alerts that are actually disabled.

title
disabled=0 
action.hangout_chat_alert=0
and action.email=blank

my understanding with the 1 , 0 , and blank is
1 is enabled
0 is disabled
and blank is that it was not setup with that action.

Now on the original post
you can see Mr @woodcock is explaining below that alert.track=1 means its a alert and 0 means its a report.
with all the other ones I don't believe it works the same .
is there a documentation that has this topic covered?

and how does my alert above fall into with action.email=0 even though I clearly have not set that action with my alert.  only hangoutchat as the action.

ALL APPS:

|rest/servicesNS/-/-/saved/searches | search alert.track=1 | fields title description search disabled triggered_alert_count actions action.script.filename alert.severity cron_schedule

Search app only:

|rest/servicesNS/-/search/saved/searches | search alert.track=1 | fields title description search disabled triggered_alert_count actions action.script.filename alert.severity cron_schedule

[livehybrid · Accepted solution]

Hi @Cheng2Ready 

If you have a look in $SPLUNK_HOME/etc/system/default/savedsearches.conf - you can see some of the default values for items you're referring to, for example:

action.email               = 0
action.populate_lookup     = 0
action.rss                 = 0
action.script              = 0

This ultimately means these arent configured, because if they were configured for a specific report/search/alert then the value would be updated to 1.

Not all variables are alike - Developers who create and share their own alert actions might use different default values (e.g. blank instead of 0).

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will