What is the query string to create an alert to trigger when another user creates an alert?

[jordanm]

Hello -

We are trying to determine how to create an alert to tell us when other users create alerts. I'm aware this is somewhat recursive thinking.

index=_internal sourcetype=scheduler user=maidman | eval is_realtime=if(searchmatch("sid=rt* OR concurrency_category=real-time_scheduled"),"yes","no")
|table savedsearch_name, user, date_hour, date_minute

Tells me when an alert ran but not the creation date.

[renjujacob88]

The logic below populates all the alerts to the test_alert_track lookup and display the alerts which are created within one day.

|rest splunk_server=local /servicesNS/-/search/saved/searches | search alert.track=1
| eval updated = strptime(updated,"%Y-%m-%dT%H:%M:%S")
| stats max(updated) as lastTime min(updated) as firsTime values(author) as author values(alert.track) as alert.track by title
| inputlookup append=t test_alert_track.csv
| stats min(firsTime) as firsTime max(lastTime) as lastTime values(author) as author values(alert.track) as alert.track by title
| outputlookup test_alert_track.csv
| search author!=nobody
| where now()-firsTime < 86400