https://community.splunk.com/t5/Alerting/how-to-get-list-of-alerts-which-are-disabled-within-24-hours/m-p/114355#M1682 <P>Possibly but I think it would be highly inadvisable. </P> Mon, 24 Aug 2015 17:37:22 GMT woodcock 2015-08-24T17:37:22Z https://community.splunk.com/t5/Alerting/how-to-get-list-of-alerts-which-are-disabled-within-24-hours/m-p/114352#M1679 <P>I have couple of alerts, among of these alerts some of alerts are disabled. Some of alerts are disabled a week ago, some of alerts are disabled within last 24 hours, I need list of that alert which are disabled within 24 hours only. </P> Thu, 09 Jul 2015 09:50:20 GMT https://community.splunk.com/t5/Alerting/how-to-get-list-of-alerts-which-are-disabled-within-24-hours/m-p/114352#M1679 chandanjaisal 2015-07-09T09:50:20Z https://community.splunk.com/t5/Alerting/how-to-get-list-of-alerts-which-are-disabled-within-24-hours/m-p/114353#M1680 <P>You get the list of alerts like this:</P> <PRE><CODE>|rest/servicesNS/admin/search/saved/searches | search disabled=1 | table title | outputlookup mylookup </CODE></PRE> <P>You run this as a saved search every 24-hours and use <CODE>outputlookup</CODE> to save the results. You also save a similar search to run just before the first one that uses <CODE>inputlookup</CODE> and compares the 2 looking for new entries and ignoring old entries like this:</P> <PRE><CODE>|rest/servicesNS/admin/search/saved/searches | search disabled=1 | table title | eval type="new" | append [|inputlookup mylookup | eval type="old]" | stats values(type) AS types BY title | where types!="old" </CODE></PRE> Thu, 09 Jul 2015 12:54:33 GMT https://community.splunk.com/t5/Alerting/how-to-get-list-of-alerts-which-are-disabled-within-24-hours/m-p/114353#M1680 woodcock 2015-07-09T12:54:33Z https://community.splunk.com/t5/Alerting/how-to-get-list-of-alerts-which-are-disabled-within-24-hours/m-p/114354#M1681 <P>Hi Woodcock<BR /> Can we merge these two search</P> Mon, 24 Aug 2015 17:03:47 GMT https://community.splunk.com/t5/Alerting/how-to-get-list-of-alerts-which-are-disabled-within-24-hours/m-p/114354#M1681 chandanjaisal 2015-08-24T17:03:47Z https://community.splunk.com/t5/Alerting/how-to-get-list-of-alerts-which-are-disabled-within-24-hours/m-p/114355#M1682 <P>Possibly but I think it would be highly inadvisable. </P> Mon, 24 Aug 2015 17:37:22 GMT https://community.splunk.com/t5/Alerting/how-to-get-list-of-alerts-which-are-disabled-within-24-hours/m-p/114355#M1682 woodcock 2015-08-24T17:37:22Z