https://community.splunk.com/t5/Alerting/My-alert-keeps-getting-auto-disabled/m-p/346706#M11509 <P>Is there any log level as Warning or Error in the internal logs that would tell me it is disabled? This is what I was leaning towards this more than getting the time difference. <BR /> However still your answer is helpful and i will try that thanks </P> Tue, 17 Apr 2018 16:02:32 GMT delgendy 2018-04-17T16:02:32Z https://community.splunk.com/t5/Alerting/My-alert-keeps-getting-auto-disabled/m-p/346704#M11507 <P>I have an alert that keeps getting auto disabled, how can I identify this from the internal logs. <BR /> I want to run a search on the internal logs to know when this alert got disabled and to alert off .</P> Tue, 17 Apr 2018 12:02:06 GMT https://community.splunk.com/t5/Alerting/My-alert-keeps-getting-auto-disabled/m-p/346704#M11507 delgendy 2018-04-17T12:02:06Z https://community.splunk.com/t5/Alerting/My-alert-keeps-getting-auto-disabled/m-p/346705#M11508 <P>You can try this search to get last run of that alert before it disabled:</P> <PRE><CODE>index=_internal sourcetype=scheduler | stats latest(_time) as last_event by savedsearch_name | eval last_run=tostring(now()-last_event,"duration") | eval last_event=strftime(last_event, "%Y-%m-%d %H:%M:%S") </CODE></PRE> Tue, 17 Apr 2018 12:26:48 GMT https://community.splunk.com/t5/Alerting/My-alert-keeps-getting-auto-disabled/m-p/346705#M11508 p_gurav 2018-04-17T12:26:48Z https://community.splunk.com/t5/Alerting/My-alert-keeps-getting-auto-disabled/m-p/346706#M11509 <P>Is there any log level as Warning or Error in the internal logs that would tell me it is disabled? This is what I was leaning towards this more than getting the time difference. <BR /> However still your answer is helpful and i will try that thanks </P> Tue, 17 Apr 2018 16:02:32 GMT https://community.splunk.com/t5/Alerting/My-alert-keeps-getting-auto-disabled/m-p/346706#M11509 delgendy 2018-04-17T16:02:32Z