Splunk Alerts Report

[johann2017]

I want to know which Splunk alerts have fired off in X amount of time. What are my options for doing this? Thanks!

[aberkow]

There are a number of ways, including looking in the monitoring console (settings -> monitoring console -> search -> scheduled search history).

To look at alerts that have fired/triggered, try

index=_internal earliest=-{inputNumberOfHours}h result_count>0
 | stats count by savedsearch_id

[johann2017]

Nice - how do I find the savedsearch_id?

[richgalloway]

See Activity->Triggered Alerts

[johann2017]

I like this however its not showing all fired alerts. I selected "All" for App, Owner, Severity, and Alert. I noticed that under the alert drop down there are only 10 alerts listed. I have built a lot more than 10. Permissions issue possibly?

[richgalloway]

If you built them then you should have permissions to view them. Are you sure the others fired?