Searching for logs that have generated an alert

[Mahieu]

Hello there,

Has anyone got a solution to see easily all the logs that have "participated" in generating an alert ?
The idea is to have a kind of search that would return everything i can see when i go to "Alerts" and click "View results" for each. Let's assume i've got 100 fired alerts and i don't want to click a hundred times on view results.

I've found a way to see all the alerts that have been fired by something like :
index="_audit" sourcetype="audittrail" action="alert_fired" ss_name="" sid=""
Now i'd like to have all the results but i'm stuck.

Thanks a lot in advance for your help.

M.

[RubenOlsen]

One, possible, untested solution, using the CLI:

1. Execute a variant of this search(splunk search 'index="_audit" sourcetype="audittrail" action="alert_fired" | eval trigger_time=strftime(trigger_time,"%Y-%m-%d %H:%M:%S") | dedup ss_name | table trigger_time, ss_name ' -auth user:pass) which return two columns: trigger_time and ss_name.

2. Iterate over the output of #1 as a input to running saved searches with the value of ss_name with trigger_time as an argument to latest= (splunk search '|savedsearch "Name Of Saved Search from #1 above" latest_time="2011-12-20 10:00:31" | table source ' -auth user:pass *) which will return the value of the soruce-field.

[Mahieu]

Back at the office on monday, i'll give it a go. Thanks for the answer, i'll keep you posted.

[Mahieu]

Last try 😕

[Mahieu]

Anyone ???