Alerting

Can you get metadata from an alert or report in search?

eli_mz
Explorer

I'd like to run a search that would give me the metadata for all reports\alerts (creator, app, schedule, etc.) so that I can view all of this information on a single page. Is this possible? The main goal of this is to look at all scheduled report\alert times and see if there's any time where the reports\alerts are running more. So to be clear, I'm not after fired alerts, I'm after the schedule (though I suppose I could use the times on the fired alerts... hmm).

Any how, I'm open to suggestions and discussion. 😄

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

If your prime purpose is to identify times where you've too many searches running, you could use internal log of the splunk scheduler. The base query will be this

index=_internal sourcetype=scheduler

The logs will have important fields like scheduled_time (time when the scheduled report/alert was scheduled to run), dispatch_time (time when it actually started to run) and status (status of the report/alert). You can then run necessary aggregation command to find the report you want.

If you just want to list all searches/reports, you can use | rest command to do so, which gives all the metadata about the search.

| rest splunk_server=local /servicesNS/-/-/saved/searches 

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

If your prime purpose is to identify times where you've too many searches running, you could use internal log of the splunk scheduler. The base query will be this

index=_internal sourcetype=scheduler

The logs will have important fields like scheduled_time (time when the scheduled report/alert was scheduled to run), dispatch_time (time when it actually started to run) and status (status of the report/alert). You can then run necessary aggregation command to find the report you want.

If you just want to list all searches/reports, you can use | rest command to do so, which gives all the metadata about the search.

| rest splunk_server=local /servicesNS/-/-/saved/searches 
0 Karma

AVOLLMER
Explorer

From the result set returned by the rest api call, is there a way to identify which are alerts and which are reports?

0 Karma

eli_mz
Explorer

I think I can work with that. Thank you!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...