My alert keeps getting auto disabled

[delgendy]

I have an alert that keeps getting auto disabled, how can I identify this from the internal logs.
I want to run a search on the internal logs to know when this alert got disabled and to alert off .

[p_gurav]

You can try this search to get last run of that alert before it disabled:

index=_internal sourcetype=scheduler  | stats latest(_time) as last_event by savedsearch_name | eval last_run=tostring(now()-last_event,"duration") | eval last_event=strftime(last_event, "%Y-%m-%d %H:%M:%S")

[delgendy]

Is there any log level as Warning or Error in the internal logs that would tell me it is disabled? This is what I was leaning towards this more than getting the time difference.
However still your answer is helpful and i will try that thanks