I need to write search queries to list all the dashboards and reports saved in my splunk environment. I was able to list the dashboards by using
| rest /servicesNS/-/-/data/ui/views | search isDashboard=1 | search eai:acl.app=search |
but I am unable to write a query for the latter.
i thought | rest /servicesNS/-/-/data/ui/views | would at least list all the reports (among other views) and i would be able to filter the rest out. Unfortunately, this isn't even listing all the reports available to me.
I am a new user and any help is greatly appreciated.
Hi saikatr,
how about using this REST endpoint:
| rest /services/saved/searches
cheers, MuS
Hi saikatr,
how about using this REST endpoint:
| rest /services/saved/searches
cheers, MuS
Thanks MuS,
This clearly sets me on the right path, This gave me a nice mix of reports and alerts:
| rest /services/saved/searches/ | search is_visible=1 | fields title is_scheduled is_visible eai:acl.perms.write eai:acl.sharing
Would you by any chance be able to test this query and inform what might be the critical step to be able to list the reports and alerts separately?
Did you ever get this resolved?
I see this is an old comment but am trying to accomplish the same thing now as well (list reports and alerts in separate dashboard panels).
Hello,
This is definitely an old post, but can anyone share how they have created a search to accurately list whether a saved search is either a report or an alert.
This list exists under the menu item Searches, Reports & Alerts as the column Type lists whether it's a report or an alert, but the code underneath doesn't seem to be viewable like selecting a panel in a dashboard will show the underlying SPL.
Also that report from Searches, Reports & Alerts which shows the Type doesn't seem to be exportable.
Hi
here is my old answer https://community.splunk.com/t5/Monitoring-Splunk/How-do-I-export-all-alerts-to-csv-or-pdf/m-p/62922...
r. Ismo