Alerting

How to access to the triggered alerts in the past in the current alert SPL?

damucka
Builder

Hello,

I need to access the alerts triggered in the past in my current alert SPL.
I have a use case where I need to know what were the settings of the result variables there (in the past triggered alerts).
Is something like that possible at all?

Kind Regards,
Kamil

Tags (2)
0 Karma
1 Solution

crliddy
Engager

Hi, in your alert, I would be pushing the results to a summary index or lookup table. Once you have your results, you can use the sistats command or the outputcsv command. Once you have this data stored, you can retrieve this with a join/append or a lookup.

View solution in original post

0 Karma

Azeemering
Builder

You can run the following search to see your environment's triggered alerts:

index=_audit action=alert_fired ss_app=* | eval ttl=expiration-now() | search ttl>0 | convert ctime(trigger_time) | table trigger_time ss_name severity | rename trigger_time as "Alert Time" ss_name as "Alert Name" severity as "Severity"

dearbhavana
Observer

I tried this splunk query for the past triggered alerts but no results found for this search. not sure why. can you pls guide here ?

0 Karma

mohanrajm
Explorer

Thanks for this query. It is working perfectly!

0 Karma

crliddy
Engager

Hi, in your alert, I would be pushing the results to a summary index or lookup table. Once you have your results, you can use the sistats command or the outputcsv command. Once you have this data stored, you can retrieve this with a join/append or a lookup.

0 Karma

damucka
Builder

@crliddy

Yes, this is what I am going to do - use kv store and then retrieve the data.

Kind Regards,
Kamil

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...