Splunk Search

How to list duplicate alerts

zawan
Engager

I am trying to optimize my splunk deployment by removing duplicate alerts.

I have this search which shows me all of the alerts and the actual searches but I want to narrow it down to only show events with a duplicate name or search so that I can remove them.

| rest /servicesNS/-/-/saved/searches/ splunk_server=local 
| search is_scheduled=1 
| fields title search
| rename title AS savedsearch_name 
| table savedsearch_name search
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This search will get you duplicate searches. You should be able to modify it to get duplicate names, although I'm not sure that's very useful.

| rest /servicesNS/-/-/saved/searches/ splunk_server=local 
| search is_scheduled=1 
| fields eai:acl.app title search | stats values(eai:acl.app) as app, values(title) as title, count by search | where count > 1

Keep in mind it's possible to have duplicate alerts where the search strings don't match as there is more than one way to accomplish the same task in SPL.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

This search will get you duplicate searches. You should be able to modify it to get duplicate names, although I'm not sure that's very useful.

| rest /servicesNS/-/-/saved/searches/ splunk_server=local 
| search is_scheduled=1 
| fields eai:acl.app title search | stats values(eai:acl.app) as app, values(title) as title, count by search | where count > 1

Keep in mind it's possible to have duplicate alerts where the search strings don't match as there is more than one way to accomplish the same task in SPL.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...