Splunk Search

Need splunk query to get alerts/saved searches/dashboards created by each index

srinivasup
Explorer

Can anyone help me to get all saved searches/alerts configured using particular index .

Tags (1)
0 Karma

woodcock
Esteemed Legend

This will do it BUT there is a problem:

| rest /servicesNS/-/-/saved/searches 
| table search title
| rex max_match=0 field=search "(?<=^|\s|\[)index\s*=\s*(?<index>(?:\"[^\"]+\")|\S+)" 
| rex field=index mode=sed "s/\"//g"
| fillnull value="N/A" index
| stats values(title) BY index

The problem is that it does not handle any cases where index is not specified literally inside the search string. These cases include: |savedsearch, |loadjob, eventtypes, macros tags, the use of Indexes searched by default (which may vary depending on user and role) and probably other things that I am missing. Also note that values (and limit) are limited to a maximum of 1000 values.

0 Karma

srinivasup
Explorer

Its not giving expected results.

Would like to search for one index and for this index would like to know alerts, saved searches configured by using this index.

0 Karma

woodcock
Esteemed Legend

You are right; I only did half the work; see the updated answer.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...