https://community.splunk.com/t5/Alerting/Use-REST-for-alert-information/m-p/530123#M9968 <P>I am using the rest services within the search to get information on alerts that have triggered. I am trying to piece together alert information and can find most of it. What I am unable to find; maybe not knowing all the fields, is the trigger time. I see that fired_alerts has the next_scheduled_time but I don't see that it has the triggered time. I do not have access to _index so I am working on getting some of this information here if possible.</P> Thu, 19 Nov 2020 19:04:52 GMT aohls 2020-11-19T19:04:52Z https://community.splunk.com/t5/Alerting/Use-REST-for-alert-information/m-p/530123#M9968 <P>I am using the rest services within the search to get information on alerts that have triggered. I am trying to piece together alert information and can find most of it. What I am unable to find; maybe not knowing all the fields, is the trigger time. I see that fired_alerts has the next_scheduled_time but I don't see that it has the triggered time. I do not have access to _index so I am working on getting some of this information here if possible.</P> Thu, 19 Nov 2020 19:04:52 GMT https://community.splunk.com/t5/Alerting/Use-REST-for-alert-information/m-p/530123#M9968 aohls 2020-11-19T19:04:52Z https://community.splunk.com/t5/Alerting/Use-REST-for-alert-information/m-p/530127#M9969 <P>The unintuitive place to find that is in the triggered_alert_count field in&nbsp;<FONT face="courier new,courier">| rest /services/saved/searches</FONT></P> Thu, 19 Nov 2020 20:21:23 GMT https://community.splunk.com/t5/Alerting/Use-REST-for-alert-information/m-p/530127#M9969 richgalloway 2020-11-19T20:21:23Z https://community.splunk.com/t5/Alerting/Use-REST-for-alert-information/m-p/530128#M9970 <P>This tells the count for the alert but not the time.</P> Thu, 19 Nov 2020 20:53:32 GMT https://community.splunk.com/t5/Alerting/Use-REST-for-alert-information/m-p/530128#M9970 aohls 2020-11-19T20:53:32Z https://community.splunk.com/t5/Alerting/Use-REST-for-alert-information/m-p/530225#M9972 <P>Sorry for providing the wrong information.</P><P>The trigger_time field is not returned as part of the general alerts/fired-alerts query.&nbsp; You get it only when you request information about a specific alert name.</P><P>&nbsp;</P> Fri, 20 Nov 2020 15:04:02 GMT https://community.splunk.com/t5/Alerting/Use-REST-for-alert-information/m-p/530225#M9972 richgalloway 2020-11-20T15:04:02Z