Alerting

How can I export all items from Settings>Searches, Reports, and Alerts?

metalgear138
Engager

So basically, I'm looking to effectively export/retrieve all content from Settings>Searches, Reports, and Alerts. Basically looking to build a reference document to list my alerts/reports with the underlying search. Is there a simple way to pull these from a location in the OS file structure instead of manually recording them from the UI? Tedious task, I know!

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Splunk stores knowledge objects in conf files. Saved search and alerts can be found in savedsearches.conf.

The location of the file depends on the permissions ie; if user hasn't shared the search then it will be under user's directory, if it's shared in app, it will be in etc/apps/appname default or local directory

or just run

splunk cmd btool --debug savedsearches list 

or use rest

| rest /servicesNS/-/-/saved/searches splunk_server=local
Happy Splunking!

yannK
Splunk Employee
Splunk Employee

remark, with a btool you will only find the public or shared saved searches
from the system $SPLUNK_HOME/etc/system/(local|default)/savedsearches.conf
and from the apps $SPLUNK_HOME/etc/apps/(appname)/(local|default)/savedsearches.conf

If you want to find the "private" saved searched, you have to go in each profile
from $SPLUNK_HOME/etc/users/(username)/(appname)/(local|default)/savedsearches.conf

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...