Reporting

Wanting to retrieve the recipient list associated with a scheduled search

Runals
Motivator

I'm trying to generate a report that shows scheduled searches and who is on the recipient list for emails. While I can go into the scheduler log and see what scheduled searches have fired I don't see an easy way to tie that back to who the email was sent to (other than manually going through each search).

Update
At least as far as 5.0.5 you can link the scheduler log with they python log via sid. Unfortunately the sid in the python log isn't populated for dashboards that have a scheduled delivery. At least as far as what I've been able to find.

Tags (1)
0 Karma

MuS
Legend

Hi Runals,

if I get it right, you can use the REST end point /services/saved/searches/ and check the fields action.email.bcc and action.email.cc. For example try this:

| rest /services/saved/searches/ | where 'action.email'!=0 | table title action.email.bcc action.email.cc

this will use all saved searches with enabled alerting and shows the name of the saved search and its recipients.

hope this helps ...

cheers, MuS

Runals
Motivator

That MuS - this gets me closer. The challenge is it isn't displaying information related to dashboards that have been scheduled for pdf delivery. Those show up as saved searches in the GUI (guessing in savedsearches.conf but haven't checked now that I think about it). It also appears to only return results for searches in the search app.

0 Karma

MuS
Legend

Hi @Runals, if you want to get all saved searches, use this REST search:

| rest /servicesNS/-/-/saved/searches/

Still not sure about the recipient part thought 😉

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...