SPL for Wrong Written Searches

[onur]

Hi,

I have a problem about wrong written searches. In our system, there are so many users. Every user will be able to create their own alert and reports. In this part, We would like to take an action for wrong written searches. How can we write an spl in saved searches to see which reports or alerts written wrong. Then, we will use RestAPI to delete them for the health of the system.

Thank you very much for your helps.

[richgalloway]

Use the REST API to get a list of saved searches.

| rest splunk_server=local /services/saved/searches

Then use appropriate SPL commands, like rex and regex, to search the "search" field for wrongness.  The specifics will depend on your definition of "wrong written".