Alerting

How to access to the triggered alerts in the past in the current alert SPL?

damucka
Builder

Hello,

I need to access the alerts triggered in the past in my current alert SPL.
I have a use case where I need to know what were the settings of the result variables there (in the past triggered alerts).
Is something like that possible at all?

Kind Regards,
Kamil

Tags (2)
0 Karma
1 Solution

crliddy
Engager

Hi, in your alert, I would be pushing the results to a summary index or lookup table. Once you have your results, you can use the sistats command or the outputcsv command. Once you have this data stored, you can retrieve this with a join/append or a lookup.

View solution in original post

0 Karma

Azeemering
Builder

You can run the following search to see your environment's triggered alerts:

index=_audit action=alert_fired ss_app=* | eval ttl=expiration-now() | search ttl>0 | convert ctime(trigger_time) | table trigger_time ss_name severity | rename trigger_time as "Alert Time" ss_name as "Alert Name" severity as "Severity"

dearbhavana
Observer

I tried this splunk query for the past triggered alerts but no results found for this search. not sure why. can you pls guide here ?

0 Karma

mohanrajm
Explorer

Thanks for this query. It is working perfectly!

0 Karma

crliddy
Engager

Hi, in your alert, I would be pushing the results to a summary index or lookup table. Once you have your results, you can use the sistats command or the outputcsv command. Once you have this data stored, you can retrieve this with a join/append or a lookup.

0 Karma

damucka
Builder

@crliddy

Yes, this is what I am going to do - use kv store and then retrieve the data.

Kind Regards,
Kamil

0 Karma
Get Updates on the Splunk Community!

Splunk is Nurturing Tomorrow’s Cybersecurity Leaders Today

Meet Carol Wright. She leads the Splunk Academic Alliance program at Splunk. The Splunk Academic Alliance ...

Part 2: A Guide to Maximizing Splunk IT Service Intelligence

Welcome to the second segment of our guide. In Part 1, we covered the essentials of getting started with ITSI ...

Part 1: A Guide to Maximizing Splunk IT Service Intelligence

As modern IT environments continue to grow in complexity and speed, the ability to efficiently manage and ...