How can I get the creation-date of alerts?

[anilkumaryadav]

Hi,

I have searched across the answers community and came to know that updated can give nearby datetime when alert was last modified. But I want to get a list of alerts with creator, creation-date.
Is there any way to achieve it?

Thanks,
Anil

[vinaybandaru]

Hi @anilkumaryadav ,

I don't know if it is correct but you can try with below query if i'm not wrong if you have the data retention for _audit index that covers the creation time of alerts.

index=_audit ss_name "alertname" action=search | dedup source sortby +_time | table _time,user

Thanks,
Vinay