I think the above answers are correct but this cleans things up and gives more info. As this is 2020, you the below search is not bound by Splunk 6.x or 7.x- it should work universally. | rest /services/saved/searches | search action.email.to=* action.email=1 | rename eai:acl.app as Application, title as "Alert Name", triggered_alert_count as "Times Triggered Conditions Met", splunk_server as Host, action.email.to as "Sent To" | table Application, "Alert Name", "Times Triggered Conditions Met", Host, "Sent To"
... View more