Alerting

splunk: View the alerts created by another user

kimberlytrayson
Path Finder

We are using splunk enterprise in our organization. Is it possible to view the alerts created by another user?

I went to

Reports and Dashboards -> Alerts

Clicked on All. Searched for the other user's name in the searchbox but no results come up.

Thanks for reading.alt text

Tags (2)
0 Karma

woodcock
Esteemed Legend

Try this:

|rest/servicesNS/-/-/saved/searches splunk_server=local
| where 'alert.track'="1" AND ('eai:acl.owner' = "sumguy" OR owner = "sumguy")
| dedup id
| rename dispatch.* AS *
| rename eai:acl.* AS *
| table owner sharing title search description* *
| sort 0 title

And, just in case somebody comes here expecting alert to mean something else, here is that answer, too:

| rest /servicesNS/-/-/alerts/fired_alerts/- splunk_server=local
| addinfo
| where trigger_time >= info_min_time
| table trigger_time author eai:acl.owner eai:acl.app savedsearch_name sid eai:acl.sharing digest_mode id published *
| rename eai:acl.* AS *
| search author="sumguy" OR owner="sumguy"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...