https://community.splunk.com/t5/Alerting/Monitoring-Splunk-alerts/m-p/118322#M1775 <P>You can start with searching for the _internal index for alert_actions field data:</P> <PRE><CODE>index=_internal alert_actions="*" </CODE></PRE> <P>This will get you the raw data.</P> <P>To count the times an alert has been triggered and get a list of which searches they are, use:</P> <PRE><CODE>index=_internal alert_actions="*" | top alert_actions,savedsearch_name limit=0 </CODE></PRE> <P>Cheers,<BR /> Jesse</P> Mon, 28 Sep 2020 15:06:30 GMT jtrucks 2020-09-28T15:06:30Z https://community.splunk.com/t5/Alerting/Monitoring-Splunk-alerts/m-p/118321#M1774 <P>Hi,</P> <P>We recently gave customers the ability to create their own alerts into our ticket management system. I'm concerned that some customers will flood either the ticketing system, or email in-boxes. Is there anyway to monitor the number of alerts that are getting generated in Splunk, similiar to any other data-source? </P> Mon, 28 Oct 2013 17:08:19 GMT https://community.splunk.com/t5/Alerting/Monitoring-Splunk-alerts/m-p/118321#M1774 a212830 2013-10-28T17:08:19Z https://community.splunk.com/t5/Alerting/Monitoring-Splunk-alerts/m-p/118322#M1775 <P>You can start with searching for the _internal index for alert_actions field data:</P> <PRE><CODE>index=_internal alert_actions="*" </CODE></PRE> <P>This will get you the raw data.</P> <P>To count the times an alert has been triggered and get a list of which searches they are, use:</P> <PRE><CODE>index=_internal alert_actions="*" | top alert_actions,savedsearch_name limit=0 </CODE></PRE> <P>Cheers,<BR /> Jesse</P> Mon, 28 Sep 2020 15:06:30 GMT https://community.splunk.com/t5/Alerting/Monitoring-Splunk-alerts/m-p/118322#M1775 jtrucks 2020-09-28T15:06:30Z