https://community.splunk.com/t5/Alerting/Search-for-Alerts/m-p/106147#M1518 <P>There is another answer on this:<BR /> <A href="http://splunk-base.splunk.com/answers/517/how-to-search-recent-alerts-fired-by-splunk" target="_blank">http://splunk-base.splunk.com/answers/517/how-to-search-recent-alerts-fired-by-splunk</A></P> <P>index=_audit action=alert_fired | eval ttl=expiration-now() | search ttl&gt;0 | convert ctime(trigger_time) | table trigger_time ss_name severity</P> Mon, 28 Sep 2020 12:43:39 GMT jharty_splunk 2020-09-28T12:43:39Z https://community.splunk.com/t5/Alerting/Search-for-Alerts/m-p/106146#M1517 <P>How can I do a search for all of the active alerts? I found something that does it via REST but I want to do a search. </P> Mon, 29 Oct 2012 21:38:38 GMT https://community.splunk.com/t5/Alerting/Search-for-Alerts/m-p/106146#M1517 peter_gianusso 2012-10-29T21:38:38Z https://community.splunk.com/t5/Alerting/Search-for-Alerts/m-p/106147#M1518 <P>There is another answer on this:<BR /> <A href="http://splunk-base.splunk.com/answers/517/how-to-search-recent-alerts-fired-by-splunk" target="_blank">http://splunk-base.splunk.com/answers/517/how-to-search-recent-alerts-fired-by-splunk</A></P> <P>index=_audit action=alert_fired | eval ttl=expiration-now() | search ttl&gt;0 | convert ctime(trigger_time) | table trigger_time ss_name severity</P> Mon, 28 Sep 2020 12:43:39 GMT https://community.splunk.com/t5/Alerting/Search-for-Alerts/m-p/106147#M1518 jharty_splunk 2020-09-28T12:43:39Z