I'm trying to generate a report that shows scheduled searches and who is on the recipient list for emails. While I can go into the scheduler log and see what scheduled searches have fired I don't see an easy way to tie that back to who the email was sent to (other than manually going through each search).
Update
At least as far as 5.0.5 you can link the scheduler log with they python log via sid. Unfortunately the sid in the python log isn't populated for dashboards that have a scheduled delivery. At least as far as what I've been able to find.
Hi Runals,
if I get it right, you can use the REST end point /services/saved/searches/
and check the fields action.email.bcc
and action.email.cc
. For example try this:
| rest /services/saved/searches/ | where 'action.email'!=0 | table title action.email.bcc action.email.cc
this will use all saved searches with enabled alerting and shows the name of the saved search and its recipients.
hope this helps ...
cheers, MuS
That MuS - this gets me closer. The challenge is it isn't displaying information related to dashboards that have been scheduled for pdf delivery. Those show up as saved searches in the GUI (guessing in savedsearches.conf but haven't checked now that I think about it). It also appears to only return results for searches in the search app.
Hi @Runals, if you want to get all saved searches, use this REST search:
| rest /servicesNS/-/-/saved/searches/
Still not sure about the recipient part thought 😉
cheers, MuS