I have searched across the answers community and came to know that updated can give nearby datetime when alert was last modified. But I want to get a list of alerts with creator, creation-date.
Is there any way to achieve it?
Hi @anilkumaryadav ,
I don't know if it is correct but you can try with below query if i'm not wrong if you have the data retention for _audit index that covers the creation time of alerts.
index=_audit ss_name "alertname" action=search | dedup source sortby +_time | table _time,user