Is there anyway to find the created timestamp of an alert ?

[dilsheer]

is ther any way to find the created timestamp of an alert ?

[niketn]

@dilsheer, provided you have access you can try the following REST API call for getting the details for Triggered Alerts, including Triggered Time:

| rest /servicesNS/<ownerRole>/<yourSplunkAppName>/alerts/fired_alerts/<yourAlertNameURLEncoded>
| dedup "eai:acl.owner" "eai:acl.app" savedsearch_name
| search "eai:acl.owner"="<ownerRole>" "eai:acl.app"="<yourSplunkAppName>" savedsearch_name="<yourAlertNameAsIs>"
| table savedsearch_name "eai:acl.owner" "eai:acl.app" trigger_time id

Please find the Splunk Documentation for corresponding REST API: http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#alerts.2Ffired_alerts.2F.7Bnam...

PS:

• While providing the Alert {Name} in REST, make sure you have it URL Encoded i.e. space becomes %20.
• Obviously this endpoint will work only for Alerts that are Enabled.
• Replace, <ownerRole>, <yourSplunkAppName>, <yourAlertNameURLEncoded> and <yourAlertNameAsIs> with what you have in your system.