How can I fetch the list of reports that trigger an email or run a script after completion?
Try something like:
| rest /services/saved/searches |search action.email=1|rename eai:acl.app as Application| table title updated description application action.email.to
The table fields are just suggestions - take a look at whats listed and see what you find useful.
Try something like:
| rest /services/saved/searches |search action.email=1|rename eai:acl.app as Application| table title updated description application action.email.to
The table fields are just suggestions - take a look at whats listed and see what you find useful.
Thanks. working Perfect
Try this
| rest /servicesNS/-/-/savedsearches splunk_server=local | search actions=* | table title author eai:acl.app search cron_schedule alert.*