Alerting

Find alerts that have triggered without alert.track

antb
Path Finder

Hi All,

I have some alerts configured to email as the only action. Alert.track (Add to Triggered Alerts) is not enabled. I've tried to find evidence anywhere in Splunk logs that these alerts have fired, however, I'm unable.

I've tried looking in :

| rest splunk_server=local /servicesNS/-/-/saved/searches

as well as:
index=_audit action=alert_fired ss_app=myapp

However, neither appear to show evidence that the alert has fired (Yes, I receive the email). It's possible I'm just missing it or it is logged in another area?

Thank you.

Labels (1)
0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

Check scheduler logs. Below query gives list of scheduled searches triggered with alert action.

index=_internal sourcetype=scheduler search_type=scheduled alert_actions!="" | table savedsearch_name, sid, app, alert_actions, scheduled_time, *time

View solution in original post

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Check scheduler logs. Below query gives list of scheduled searches triggered with alert action.

index=_internal sourcetype=scheduler search_type=scheduled alert_actions!="" | table savedsearch_name, sid, app, alert_actions, scheduled_time, *time
0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...