Is there a way to determine how many email alerts are being sent from my Splunk server per hour, day or week?

[JoeSco27]

I have about 100 alerts scheduled to run on different conditions and send emails if those conditions are met. Is there a way to determine how many emails are actually being sent per day/hour/week from my splunk server?

[martin_mueller · Accepted solution]

Try something like this:

index=_internal sourcetype=scheduler alert_actions=*email* | timechart span=1d sum(fired) as "Emails sent per day"

[martin_mueller]

If you don't have per-result alerts then yeah, counting those events will do.

[JoeSco27]

For some reason fired didn't produce the correct results, but the count of events over time worked for us. Thank you for your help.