Splunk Search

SPL for Wrong Written Searches

onur
Explorer

Hi,

I have a problem about wrong written searches. In our system, there are so many users. Every user will be able to create their own alert and reports. In this part, We would like to take an action for wrong written searches. How can we write an spl in saved searches to see which reports or alerts written wrong. Then, we will use RestAPI to delete them for the health of the system.

Thank you very much for your helps.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use the REST API to get a list of saved searches.

| rest splunk_server=local /services/saved/searches

Then use appropriate SPL commands, like rex and regex, to search the "search" field for wrongness.  The specifics will depend on your definition of "wrong written".

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...