Splunk Search

SPL for Wrong Written Searches



I have a problem about wrong written searches. In our system, there are so many users. Every user will be able to create their own alert and reports. In this part, We would like to take an action for wrong written searches. How can we write an spl in saved searches to see which reports or alerts written wrong. Then, we will use RestAPI to delete them for the health of the system.

Thank you very much for your helps.

Labels (1)
0 Karma


Use the REST API to get a list of saved searches.

| rest splunk_server=local /services/saved/searches

Then use appropriate SPL commands, like rex and regex, to search the "search" field for wrongness.  The specifics will depend on your definition of "wrong written".

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...