topic Re: Splunk Alerts Report in Alerting

Splunk Alerts Report

johann2017 — Thu, 09 Jan 2020 18:05:03 GMT

I want to know which Splunk alerts have fired off in X amount of time. What are my options for doing this? Thanks!

Re: Splunk Alerts Report

richgalloway — Thu, 09 Jan 2020 18:34:44 GMT

See Activity->Triggered Alerts

Re: Splunk Alerts Report

aberkow — Thu, 09 Jan 2020 18:35:59 GMT

There are a number of ways, including looking in the monitoring console (settings -> monitoring console -> search -> scheduled search history).

To look at alerts that have fired/triggered, try

index=_internal earliest=-{inputNumberOfHours}h result_count>0
 | stats count by savedsearch_id

Re: Splunk Alerts Report

johann2017 — Thu, 09 Jan 2020 19:59:19 GMT

I like this however its not showing all fired alerts. I selected "All" for App, Owner, Severity, and Alert. I noticed that under the alert drop down there are only 10 alerts listed. I have built a lot more than 10. Permissions issue possibly?

Re: Splunk Alerts Report

johann2017 — Thu, 09 Jan 2020 20:01:00 GMT

Nice - how do I find the savedsearch_id?

Re: Splunk Alerts Report

richgalloway — Thu, 09 Jan 2020 20:22:12 GMT

If you built them then you should have permissions to view them. Are you sure the others fired?