https://community.splunk.com/t5/Alerting/How-can-I-get-the-creation-date-of-alerts/m-p/488359#M8652 <P>Hi,</P> <P>I have searched across the answers community and came to know that updated can give nearby datetime when alert was last modified. But I want to get a list of alerts with creator, creation-date.<BR /> Is there any way to achieve it?</P> <P>Thanks,<BR /> Anil</P> Fri, 17 Jan 2020 06:25:20 GMT anilkumaryadav 2020-01-17T06:25:20Z https://community.splunk.com/t5/Alerting/How-can-I-get-the-creation-date-of-alerts/m-p/488359#M8652 <P>Hi,</P> <P>I have searched across the answers community and came to know that updated can give nearby datetime when alert was last modified. But I want to get a list of alerts with creator, creation-date.<BR /> Is there any way to achieve it?</P> <P>Thanks,<BR /> Anil</P> Fri, 17 Jan 2020 06:25:20 GMT https://community.splunk.com/t5/Alerting/How-can-I-get-the-creation-date-of-alerts/m-p/488359#M8652 anilkumaryadav 2020-01-17T06:25:20Z https://community.splunk.com/t5/Alerting/How-can-I-get-the-creation-date-of-alerts/m-p/488360#M8653 <P>Hi <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/35657">@anilkumaryadav</a> ,</P> <P>I don't know if it is correct but you can try with below query if i'm not wrong if you have the data retention for _audit index that covers the creation time of alerts.</P> <P>index=_audit ss_name "alertname" action=search | dedup source sortby +_time | table _time,user</P> <P>Thanks,<BR /> Vinay</P> Wed, 30 Sep 2020 03:44:47 GMT https://community.splunk.com/t5/Alerting/How-can-I-get-the-creation-date-of-alerts/m-p/488360#M8653 vinaybandaru 2020-09-30T03:44:47Z