Alerting

How to view list of email addresses for saved alerts?

cozancin
New Member

We have a large number of saved alerts (250+). I have been asked to review the email distribution list for every one of these to identify addresses for people who no longer work for the company and remove them. There is some assumption that Splunk should make this an easy (click a couple buttons and view a consolidated list for all alerts). I have told them this is not the case (as far as I can tell). Is there a way through the web GUI or otherwise to dump this information for each alert?

Tags (2)
0 Karma

somesoni2
Revered Legend

You can utilize Splunk's Rest API endpoints to get all the searches (in the box where the search will run).

Try something like this

| rest /services/saved/searches  | table title *

Full details of the output of this command is available here.
http://docs.splunk.com/Documentation/Splunk/6.0.2/RESTAPI/RESTsearch#saved.2Fsearches

Based on your requirement, you can set filters from the output fields.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You need to use namespace wildcards to get all the searches (run as admin), I've added a filter to only load searches that have the email action enabled:

| rest /servicesNS/-/-/saved/searches search="action.email=1" | table title eai:acl.app eai:acl.owner disabled is_scheduled cron_schedule action.email*

jaxjohnny2000
Builder

@martin_mueller - Perfect!

0 Karma

cozancin
New Member

That returned some results. Out of the 250+ searchers it returned 24.

0 Karma

cozancin
New Member

Thank you, I will give it a try.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...