Splunk Search

SPL for Wrong Written Searches



I have a problem about wrong written searches. In our system, there are so many users. Every user will be able to create their own alert and reports. In this part, We would like to take an action for wrong written searches. How can we write an spl in saved searches to see which reports or alerts written wrong. Then, we will use RestAPI to delete them for the health of the system.

Thank you very much for your helps.

Labels (1)
0 Karma


Use the REST API to get a list of saved searches.

| rest splunk_server=local /services/saved/searches

Then use appropriate SPL commands, like rex and regex, to search the "search" field for wrongness.  The specifics will depend on your definition of "wrong written".

If this reply helps you, an upvote would be appreciated.
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!