https://community.splunk.com/t5/Alerting/REST-API-Doesn-t-Return-All-Alerts-From-the-audit-Index/m-p/536009#M10122 <P>Hi everyone,</P><P>I'm checking the alerts via REST API (/<FONT face="courier new,courier">servicesNS/e524067/-/alerts/fired_alerts/-</FONT>) and what I get is consistent with what is shown in Triggered Alerts view. However, if I do a search <FONT face="courier new,courier">index=_audit action=alert_fired</FONT>, I see the same alerts I get via REST but also some other alerts. I checked the expiration and trigger times, those extra alerts are fairly new and have not expired yet. What is the reason for this inconsistency?</P><P>Thanks,</P><P>Krunoslav Ivesic</P> Fri, 15 Jan 2021 14:13:42 GMT krunoslav 2021-01-15T14:13:42Z https://community.splunk.com/t5/Alerting/REST-API-Doesn-t-Return-All-Alerts-From-the-audit-Index/m-p/536009#M10122 <P>Hi everyone,</P><P>I'm checking the alerts via REST API (/<FONT face="courier new,courier">servicesNS/e524067/-/alerts/fired_alerts/-</FONT>) and what I get is consistent with what is shown in Triggered Alerts view. However, if I do a search <FONT face="courier new,courier">index=_audit action=alert_fired</FONT>, I see the same alerts I get via REST but also some other alerts. I checked the expiration and trigger times, those extra alerts are fairly new and have not expired yet. What is the reason for this inconsistency?</P><P>Thanks,</P><P>Krunoslav Ivesic</P> Fri, 15 Jan 2021 14:13:42 GMT https://community.splunk.com/t5/Alerting/REST-API-Doesn-t-Return-All-Alerts-From-the-audit-Index/m-p/536009#M10122 krunoslav 2021-01-15T14:13:42Z