Splunk Search

Questions on query to get all alerts which are configured in Splunk , 1 , 0 , and Blanks in the fields

Cheng2Ready
Communicator

So jumping into this search  question
https://community.splunk.com/t5/Alerting/How-can-I-query-to-get-all-alerts-which-are-configured/m-p/...

my search I am using:
| rest /servicesNS/-/-/saved/searches splunk_server=local
| search disabled=0
|table title, disabled, action.hangout_chat_alert, action.email

I came a across the question of there is any documentation on what the 1, 0 or Blank means? on some of the fields .
I have this alert that only has HangoutChat alert setup
when I run this query below It shows

title
disabled=0 
action.hangout_chat_alert=0
and action.email=0

I'm confused as to why email and hangout are returning the value 0
shouldn't it be like. disabled = 0 is returning me all alerts that are active and 1 is alerts that are actually disabled.

title
disabled=0 
action.hangout_chat_alert=0
and action.email=blank

my understanding with the 1 , 0 , and blank is
1 is enabled
0 is disabled
and blank is that it was not setup with that action.

Now on the original post
you can see Mr @woodcock is explaining below that alert.track=1 means its a alert and 0 means its a report.
with all the other ones I don't believe it works the same .
is there a documentation that has this topic covered?

and how does my alert above fall into with action.email=0 even though I clearly have not set that action with my alert.  only hangoutchat as the action.

Cheng2Ready_0-1740179523497.png

 






ALL APPS:

|rest/servicesNS/-/-/saved/searches | search alert.track=1 | fields title description search disabled triggered_alert_count actions action.script.filename alert.severity cron_schedule

Search app only:

|rest/servicesNS/-/search/saved/searches | search alert.track=1 | fields title description search disabled triggered_alert_count actions action.script.filename alert.severity cron_schedule

 

0 Karma
1 Solution

livehybrid
SplunkTrust
SplunkTrust

Hi @Cheng2Ready 

If you have a look in $SPLUNK_HOME/etc/system/default/savedsearches.conf - you can see some of the default values for items you're referring to, for example:

action.email               = 0
action.populate_lookup     = 0
action.rss                 = 0
action.script              = 0

This ultimately means these arent configured, because if they were configured for a specific report/search/alert then the value would be updated to 1.

Not all variables are alike - Developers who create and share their own alert actions might use different default values (e.g. blank instead of 0).

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

View solution in original post

livehybrid
SplunkTrust
SplunkTrust

Hi @Cheng2Ready 

If you have a look in $SPLUNK_HOME/etc/system/default/savedsearches.conf - you can see some of the default values for items you're referring to, for example:

action.email               = 0
action.populate_lookup     = 0
action.rss                 = 0
action.script              = 0

This ultimately means these arent configured, because if they were configured for a specific report/search/alert then the value would be updated to 1.

Not all variables are alike - Developers who create and share their own alert actions might use different default values (e.g. blank instead of 0).

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...