Splunk Search

Need splunk query to get alerts/saved searches/dashboards created by each index

srinivasup
Explorer

Can anyone help me to get all saved searches/alerts configured using particular index .

Tags (1)
0 Karma

woodcock
Esteemed Legend

This will do it BUT there is a problem:

| rest /servicesNS/-/-/saved/searches 
| table search title
| rex max_match=0 field=search "(?<=^|\s|\[)index\s*=\s*(?<index>(?:\"[^\"]+\")|\S+)" 
| rex field=index mode=sed "s/\"//g"
| fillnull value="N/A" index
| stats values(title) BY index

The problem is that it does not handle any cases where index is not specified literally inside the search string. These cases include: |savedsearch, |loadjob, eventtypes, macros tags, the use of Indexes searched by default (which may vary depending on user and role) and probably other things that I am missing. Also note that values (and limit) are limited to a maximum of 1000 values.

0 Karma

srinivasup
Explorer

Its not giving expected results.

Would like to search for one index and for this index would like to know alerts, saved searches configured by using this index.

0 Karma

woodcock
Esteemed Legend

You are right; I only did half the work; see the updated answer.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...