https://community.splunk.com/t5/Alerting/Why-audit-for-alerts-doesn-t-record-private-alerts/m-p/446366#M7842 <P>@richgalloway, it was because the alert didn't have the <STRONG>Add to Triggered Alerts action</STRONG> at <A href="https://answers.splunk.com/answers/765686/what-does-the-add-to-triggered-alerts-action-do-fo.html?minQuestionBodyLength=80">What does the Add to Triggered Alerts action do for an alert?</A></P> Thu, 15 Aug 2019 15:01:47 GMT danielbb 2019-08-15T15:01:47Z https://community.splunk.com/t5/Alerting/Why-audit-for-alerts-doesn-t-record-private-alerts/m-p/446364#M7840 <P>Based on <A href="https://answers.splunk.com/answers/763301/how-to-produce-an-alert-invocations-report.html">How to produce an alert invocations report?</A></P> <P><CODE>index=_audit action=alert_fired</CODE> doesn't seem to show private alerts that got fired. Does it make sense?</P> Wed, 14 Aug 2019 13:24:56 GMT https://community.splunk.com/t5/Alerting/Why-audit-for-alerts-doesn-t-record-private-alerts/m-p/446364#M7840 danielbb 2019-08-14T13:24:56Z https://community.splunk.com/t5/Alerting/Why-audit-for-alerts-doesn-t-record-private-alerts/m-p/446365#M7841 <P>Perhaps because the alert is private? Perhaps because _audit leaves something to be desired.<BR /> Have you looked in _internal for the information you seek?</P> Wed, 14 Aug 2019 14:41:39 GMT https://community.splunk.com/t5/Alerting/Why-audit-for-alerts-doesn-t-record-private-alerts/m-p/446365#M7841 richgalloway 2019-08-14T14:41:39Z https://community.splunk.com/t5/Alerting/Why-audit-for-alerts-doesn-t-record-private-alerts/m-p/446366#M7842 <P>@richgalloway, it was because the alert didn't have the <STRONG>Add to Triggered Alerts action</STRONG> at <A href="https://answers.splunk.com/answers/765686/what-does-the-add-to-triggered-alerts-action-do-fo.html?minQuestionBodyLength=80">What does the Add to Triggered Alerts action do for an alert?</A></P> Thu, 15 Aug 2019 15:01:47 GMT https://community.splunk.com/t5/Alerting/Why-audit-for-alerts-doesn-t-record-private-alerts/m-p/446366#M7842 danielbb 2019-08-15T15:01:47Z https://community.splunk.com/t5/Alerting/Why-audit-for-alerts-doesn-t-record-private-alerts/m-p/446367#M7843 <P>@danielbb please convert your comment to an answer n accept it as it has resolved your issue <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Thu, 15 Aug 2019 15:30:00 GMT https://community.splunk.com/t5/Alerting/Why-audit-for-alerts-doesn-t-record-private-alerts/m-p/446367#M7843 Sukisen1981 2019-08-15T15:30:00Z https://community.splunk.com/t5/Alerting/Why-audit-for-alerts-doesn-t-record-private-alerts/m-p/446368#M7844 <P>Thanks @Sukisen1981.</P> Thu, 15 Aug 2019 15:32:53 GMT https://community.splunk.com/t5/Alerting/Why-audit-for-alerts-doesn-t-record-private-alerts/m-p/446368#M7844 danielbb 2019-08-15T15:32:53Z