https://community.splunk.com/t5/Alerting/Find-alerts-that-have-triggered-without-alert-track/m-p/480819#M8511 <P>Check scheduler logs. Below query gives list of scheduled searches triggered with alert action.</P> <PRE><CODE>index=_internal sourcetype=scheduler search_type=scheduled alert_actions!="" | table savedsearch_name, sid, app, alert_actions, scheduled_time, *time </CODE></PRE> Mon, 20 Apr 2020 13:37:28 GMT manjunathmeti 2020-04-20T13:37:28Z https://community.splunk.com/t5/Alerting/Find-alerts-that-have-triggered-without-alert-track/m-p/480818#M8510 <P>Hi All, </P> <P>I have some alerts configured to email as the only action. <STRONG>Alert.track (Add to Triggered Alerts) is not enabled</STRONG>. I've tried to find evidence anywhere in Splunk logs that these alerts have fired, however, I'm unable.</P> <P>I've tried looking in : <BR /> <PRE>| rest splunk_server=local /servicesNS/-/-/saved/searches</PRE><BR /> as well as:<BR /> <PRE>index=_audit action=alert_fired ss_app=myapp</PRE> </P> <P>However, neither appear to show evidence that the alert has fired (Yes, I receive the email). It's possible I'm just missing it or it is logged in another area?</P> <P>Thank you.</P> Wed, 30 Sep 2020 05:06:32 GMT https://community.splunk.com/t5/Alerting/Find-alerts-that-have-triggered-without-alert-track/m-p/480818#M8510 antb 2020-09-30T05:06:32Z https://community.splunk.com/t5/Alerting/Find-alerts-that-have-triggered-without-alert-track/m-p/480819#M8511 <P>Check scheduler logs. Below query gives list of scheduled searches triggered with alert action.</P> <PRE><CODE>index=_internal sourcetype=scheduler search_type=scheduled alert_actions!="" | table savedsearch_name, sid, app, alert_actions, scheduled_time, *time </CODE></PRE> Mon, 20 Apr 2020 13:37:28 GMT https://community.splunk.com/t5/Alerting/Find-alerts-that-have-triggered-without-alert-track/m-p/480819#M8511 manjunathmeti 2020-04-20T13:37:28Z