topic Re: List correlation searches with number of alerts in Splunk Search

List correlation searches with number of alerts

PleaseHelp — Wed, 29 May 2024 09:10:22 GMT

https://docs.splunk.com/Documentation/ES/7.3.1/Admin/Listcorrelationsearches

Hi, I'm using the searches mentioned in the documentation. There is a field named triggered_alert_count which gives me what I want but it returns the same number of alerts across all time ranges.

| rest splunk_server=local count=0 /services/saved/searches | rename eai:acl.app as app, title as csearch_name, action.correlationsearch.label as csearch_label, action.notable.param.security_domain as security_domain, triggered_alert_count as number_of_alerts | search app="SplunkEnterpriseSecuritySuite" | table number_of_alerts, csearch_label, app, security_domain, description

Ideally I would like to see the total number of alerts as far back as Splunk remembers. Thanks.

Re: List correlation searches with number of alerts

ITWhisperer — Wed, 29 May 2024 09:53:14 GMT

As the documentation says, the ReST API that you are using returns information about the search (definition). These are not events and do not have timestamps (per se), so you are getting all the definitions already.

Re: List correlation searches with number of alerts

PleaseHelp — Wed, 29 May 2024 11:09:51 GMT

Thanks @ITWhisperer do you know how I could obtain this information?

Re: List correlation searches with number of alerts

ITWhisperer — Wed, 29 May 2024 11:36:50 GMT

You could try something like this

| rest /servicesNS/-/-/alerts/fired_alerts

Re: List correlation searches with number of alerts

marysan — Sat, 01 Jun 2024 08:04:36 GMT

Hi
I suppose that this query works for you :

index=notable | stats count as alert_num by rule_name | rename rule_name as csearch_label | lookup savedsearches csearch_label as csearch_label OUTPUTNEW action.notable.param.security_domain as security_domain, description, eai:acl.app as app | search app="SplunkEnterpriseSecuritySuite" | table alert_num, csearch_label, app, security_domain, description | sort - alert_num