https://community.splunk.com/t5/Alerting/Dashboard-for-Triggered-Alerts/m-p/172823#M2829 <P>Hi,</P> <P>I wondered if anybody had created a dashboard which shows information about triggered events. Like stats that you would expect from a service desk.</P> <P>Thanks</P> Tue, 04 Mar 2014 01:55:09 GMT j666gak 2014-03-04T01:55:09Z https://community.splunk.com/t5/Alerting/Dashboard-for-Triggered-Alerts/m-p/172823#M2829 <P>Hi,</P> <P>I wondered if anybody had created a dashboard which shows information about triggered events. Like stats that you would expect from a service desk.</P> <P>Thanks</P> Tue, 04 Mar 2014 01:55:09 GMT https://community.splunk.com/t5/Alerting/Dashboard-for-Triggered-Alerts/m-p/172823#M2829 j666gak 2014-03-04T01:55:09Z https://community.splunk.com/t5/Alerting/Dashboard-for-Triggered-Alerts/m-p/172824#M2830 <P>There are several ways to accomplish this. </P> <P>First, there is an out of box Alerts console that may provide a solution or inspire a customization. </P> <P>The <A href="http://docs.splunk.com/Documentation/Splunk/6.0.2/RESTAPI/RESTsearch#alerts.2Ffired_alerts.2F.7Bname.7D">fired alerts REST endpoint</A> can provide information too. Example of querying that endpoint using Splunk search language: </P> <PRE><CODE>| rest /services/alerts/fired_alerts splunk_server=local| table eai:acl.owner eai:acl.app id title triggered_alert_count </CODE></PRE> <P>Audit.log is another place from which you can derive information. Sample entry of fired alert:</P> <PRE><CODE>03-04-2014 00:20:01.515 -0500 INFO AuditLogger - Audit:[timestamp=03-04-2014 00:20:01.515, user=admin, action=alert_fired, ss_user="admin", ss_app="search", ss_name="test", sid="scheduler__admin__search__test_at_1393910400_4278", alert_actions="", severity=2, trigger_time=1393910401, expiration=1393996801, digest_mode=1, triggered_alerts=1][n/a] </CODE></PRE> Tue, 04 Mar 2014 05:23:44 GMT https://community.splunk.com/t5/Alerting/Dashboard-for-Triggered-Alerts/m-p/172824#M2830 bwooden 2014-03-04T05:23:44Z https://community.splunk.com/t5/Alerting/Dashboard-for-Triggered-Alerts/m-p/543008#M10305 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/87">@bwooden</a>&nbsp;the fired alerts REST endpoint works very well but how I can I restrict the time range? It doesn't respond to time range picker.</P> Tue, 09 Mar 2021 12:00:35 GMT https://community.splunk.com/t5/Alerting/Dashboard-for-Triggered-Alerts/m-p/543008#M10305 electronicbat 2021-03-09T12:00:35Z