Jagadeesh Motamarri skilledmonster

## Splunk - How to find alert actions tied to saved searches?
| rest /servicesNS/-/-/saved/searches | table title "action.email.to" "action.slack.param.channel" | search "action.email.to"!=""

## gist:2f746341e23c78faff03d93997f0e321
index=_internal source="/opt/splunk/var/log/splunk/conf.log" "data.task"=addCommit "data.optype_desc"=ASSIGN_ASSET_ID "data.dst{}"=savedsearches
| rename data.dst{} as data
| eval user=mvindex(data,0)
| eval app=mvindex(data,1)
| eval saved_search=mvindex(data,3)
| table user app saved_search

## gist:f46e1e5c7d504ee5d93a53005a47a0e4
index="common" source="testing" (environment=prod) (event=deploy OR event=complete)
| transaction event project
| eval Minutes=duration/60
| eval Minutes=round(Minutes,0)
| eval starttime = strftime(_time,"%m/%d/%y %H:%M:%S.%Q")
| eval endtime = strftime((_time + duration),"%m/%d/%y %H:%M:%S.%Q")
|  table _time project starttime endtime Minutes

## gist:b7a7469a2a7cfd180ca99caf94311fb4
| rest /servicesNS/-/-/saved/searches
|  search "action.slack.param.message"="*test*"
|  table title *slack*
	index=_internal source="/opt/splunk/var/log/splunk/conf.log" "data.task"=addCommit "data.optype_desc"=ASSIGN_ASSET_ID "data.dst{}"=savedsearches
	\| rename data.dst{} as data
	\| eval user=mvindex(data,0)
	\| eval app=mvindex(data,1)
	\| eval saved_search=mvindex(data,3)
	\| table user app saved_search
	index="common" source="testing" (environment=prod) (event=deploy OR event=complete)
	\| transaction event project
	\| eval Minutes=duration/60
	\| eval Minutes=round(Minutes,0)
	\| eval starttime = strftime(_time,"%m/%d/%y %H:%M:%S.%Q")
	\| eval endtime = strftime((_time + duration),"%m/%d/%y %H:%M:%S.%Q")
	\| table _time project starttime endtime Minutes
	\| rest /servicesNS/-/-/saved/searches
	\| search "action.slack.param.message"="test"
	\| table title slack