My alert keeps getting auto disabled


I have an alert that keeps getting auto disabled, how can I identify this from the internal logs.
I want to run a search on the internal logs to know when this alert got disabled and to alert off .

Tags (1)
0 Karma


You can try this search to get last run of that alert before it disabled:

index=_internal sourcetype=scheduler  | stats latest(_time) as last_event by savedsearch_name | eval last_run=tostring(now()-last_event,"duration") | eval last_event=strftime(last_event, "%Y-%m-%d %H:%M:%S")
0 Karma


Is there any log level as Warning or Error in the internal logs that would tell me it is disabled? This is what I was leaning towards this more than getting the time difference.
However still your answer is helpful and i will try that thanks

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...