Splunk Enterprise

How do I view / save the entire list of Reports + Alerts in Splunk Enterprise , any SPLs is much appreciated. Thank u

SamHTexas
Builder

How do I view / save the entire list of Reports + Alerts in Splunk Enterprise, any SPLs is much appreciated. 

If you would show me how to generate the same for ES. Thank u

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Start with this REST command then customize the query to produce the desired output.

| rest /servicesNS/-/-/saved/searches
---
If this reply helps you, Karma would be appreciated.
0 Karma

SamHTexas
Builder

Thank u for your reply. I am not clear. I ran:

| rest /servicesNS/-/-/saved/searches

Received general search results

Ran 

| rest /servicesNS/-/-/saved/reports     No results

| rest /servicesNS/-/-/saved/alerts        No results

 

I am sure I have many reports & alerts. I appreciate a reply. Thank u as always Rich.

 

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Reports and alerts are just saved searches so the one REST command will return them all.  For reports, the alert_type field value will be "always".

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...