How to "Export" all configured "Alerts" in a particular "App" with all configured settings including the actions etc

[iggydolby2]

I will like to "Export" all configured "Alerts" in a particular "App" with all configured settings including the actions when the alert is triggered.

I have tried some "rest" and "searches" listed on the "Community" without success.  

[richgalloway]

Use btool.

splunk btool savedsearches list -app=App > AppAlerts.txt

 This will also give you the non-alert saved searches, but you can use an editor to remove them.

If you use Splunk Cloud then submit a support ticket asking for the app's savedsearches.conf files.

[iggydolby2]

I cannot login directly to the Splunk server, only to the application.

Is the "btool" command line only available from the Enterprise server command line?

Is there a search or API call that I can make to get the information?

[richgalloway]

Yes, btool is a CLI command.  If you don't have access then perhaps you know someone who does?

You can use the REST API to get most of the information you seek.  Start with this query and then modify it to suit your needs

| rest /servicesNS/-/-/saved/searches splunk_server=local | search alert_type!="always"

[iggydolby2]

Sorry, I was out of the office. I will try this today and let you know.