How to log the alert name and the date/time the alert was triggered to a log file, not the actual search results?

[mookiie2005]

I want to create a way to log the alert name and trigger time to a log file and retain that information for 6 months - not the actual search results, just the name of the alert and time/date it was triggered. Has anyone done this before? You can save the search results and set a custom retention time for that, but in our case we don't want the search results, just the log of the alert trigger time. Please let us know if anyone has done something like this before or has an idea how to do it.

Thanks,
Sean

[woodcock]

Start with this search, which creates a report of the currently active alerts, and refine from there:

index=_audit action=alert_fired | eval ttl=expiration-now() | search ttl>0 | convert ctime(trigger_time) | table trigger_time ss_name severity

You can also do it with the REST API starting here:

| rest /servicesNS/-/-/saved/searches

https://answers.splunk.com/answers/146985/how-to-view-list-of-email-addresses-for-saved-alerts.html
http://docs.splunk.com/Documentation/Splunk/6.2.3/RESTREF/RESTsearch
http://docs.splunk.com/Documentation/Splunk/6.2.3/RESTREF/RESTsearchExamples

[mookiie2005]

This does not help at all? Splunk is only retaining the alerts for however long you have set them to be retained. We do not want to retain the results of every alert perpetually so they are still on the _audit index. What I need is a way to log alert triggers to a separate index where we can maintain the alert name, and alert time it triggered. Anyone have a practical way to do this?