Alerting

How can I get the creation-date of alerts?

anilkumaryadav
New Member

Hi,

I have searched across the answers community and came to know that updated can give nearby datetime when alert was last modified. But I want to get a list of alerts with creator, creation-date.
Is there any way to achieve it?

Thanks,
Anil

Tags (2)
0 Karma

vinaybandaru
Path Finder

Hi @anilkumaryadav ,

I don't know if it is correct but you can try with below query if i'm not wrong if you have the data retention for _audit index that covers the creation time of alerts.

index=_audit ss_name "alertname" action=search | dedup source sortby +_time | table _time,user

Thanks,
Vinay

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...