https://community.splunk.com/t5/Splunk-Dev/Splunk-python-SDK-to-find-stale-alerts/m-p/538875#M9671 <P>In <A href="https://splunkbase.splunk.com/app/3796/" target="_self">Alerts for Splunk Admins</A></P><P>or direct link to github <A href="https://github.com/gjanders/SplunkAdmins/blob/master/default/savedsearches.conf" target="_blank" rel="noopener">https://github.com/gjanders/SplunkAdmins/blob/master/default/savedsearches.conf</A></P><P>There is an alert called "SearchHeadLevel - Alerts that have not fired an action in X days"</P><P>You could run a search like that or trigger the report or similar via the SDK/REST API. That said alerts will generally run, if they never fire an action then that might be a criteria to check if they are still valid/in use</P> Sun, 07 Feb 2021 05:14:03 GMT gjanders 2021-02-07T05:14:03Z https://community.splunk.com/t5/Splunk-Dev/Splunk-python-SDK-to-find-stale-alerts/m-p/538872#M9670 <P>By using Splunk python SDK API, is there a way to find list of all Splunk alerts which have not been triggered for specified period of time? The basic idea is to run such report on regular basis and alert users on alerts which are just sitting there for specified period of time so that those alerts can be modified etc. Thanks</P> Sun, 07 Feb 2021 02:04:42 GMT https://community.splunk.com/t5/Splunk-Dev/Splunk-python-SDK-to-find-stale-alerts/m-p/538872#M9670 RS 2021-02-07T02:04:42Z https://community.splunk.com/t5/Splunk-Dev/Splunk-python-SDK-to-find-stale-alerts/m-p/538875#M9671 <P>In <A href="https://splunkbase.splunk.com/app/3796/" target="_self">Alerts for Splunk Admins</A></P><P>or direct link to github <A href="https://github.com/gjanders/SplunkAdmins/blob/master/default/savedsearches.conf" target="_blank" rel="noopener">https://github.com/gjanders/SplunkAdmins/blob/master/default/savedsearches.conf</A></P><P>There is an alert called "SearchHeadLevel - Alerts that have not fired an action in X days"</P><P>You could run a search like that or trigger the report or similar via the SDK/REST API. That said alerts will generally run, if they never fire an action then that might be a criteria to check if they are still valid/in use</P> Sun, 07 Feb 2021 05:14:03 GMT https://community.splunk.com/t5/Splunk-Dev/Splunk-python-SDK-to-find-stale-alerts/m-p/538875#M9671 gjanders 2021-02-07T05:14:03Z