Alerts How to determine how many times (frequency) Alert has been fired in a /day/month/week.

[HenryFitzerald]

Hi ,
Could anyone please assist me . I have an Alert called HBTP and is fired when a condition => search error_count>5 is true and it runs as a scheduled cron job every 15minutes=>*/15 * * * *

Could I please ask if there is a query or anyway to determine how many times its fired over a day,month or even a year in Splunk.
Thanks in advance
Henry

[skoelpin]

Check out the internal index. Once you find it, you can then use a timechart to map out relative to time. It would look something like this

index=_internal sourcetype=scheduler savedsearch_name=<ALERT NAME> fired=1

[kmaron]

It sounds like what you want is to track triggered alerts

http://docs.splunk.com/Documentation/Splunk/7.2.0/Alert/Reviewtriggeredalerts