How to view list of email addresses for saved alerts?

[cozancin]

We have a large number of saved alerts (250+). I have been asked to review the email distribution list for every one of these to identify addresses for people who no longer work for the company and remove them. There is some assumption that Splunk should make this an easy (click a couple buttons and view a consolidated list for all alerts). I have told them this is not the case (as far as I can tell). Is there a way through the web GUI or otherwise to dump this information for each alert?

[somesoni2]

You can utilize Splunk's Rest API endpoints to get all the searches (in the box where the search will run).

Try something like this

| rest /services/saved/searches  | table title *

Full details of the output of this command is available here.
http://docs.splunk.com/Documentation/Splunk/6.0.2/RESTAPI/RESTsearch#saved.2Fsearches

Based on your requirement, you can set filters from the output fields.

[martin_mueller]

You need to use namespace wildcards to get all the searches (run as admin), I've added a filter to only load searches that have the email action enabled:

| rest /servicesNS/-/-/saved/searches search="action.email=1" | table title eai:acl.app eai:acl.owner disabled is_scheduled cron_schedule action.email*

[jaxjohnny2000]

@martin_mueller - Perfect!

[cozancin]

That returned some results. Out of the 250+ searchers it returned 24.

[cozancin]

Thank you, I will give it a try.