What is the query string to create an alert to trigger when another user creates an alert?


Hello -

We are trying to determine how to create an alert to tell us when other users create alerts. I'm aware this is somewhat recursive thinking.

index=_internal sourcetype=scheduler user=maidman | eval is_realtime=if(searchmatch("sid=rt* OR concurrency_category=real-time_scheduled"),"yes","no")
|table savedsearch_name, user, date_hour, date_minute

Tells me when an alert ran but not the creation date.

Labels (1)
0 Karma

Path Finder

The logic below populates all the alerts to the test_alert_track lookup and display the alerts which are created within one day.

|rest splunk_server=local /servicesNS/-/search/saved/searches | search alert.track=1
| eval updated = strptime(updated,"%Y-%m-%dT%H:%M:%S")
| stats max(updated) as lastTime min(updated) as firsTime values(author) as author values(alert.track) as alert.track by title
| inputlookup append=t test_alert_track.csv
| stats min(firsTime) as firsTime max(lastTime) as lastTime values(author) as author values(alert.track) as alert.track by title
| outputlookup test_alert_track.csv
| search author!=nobody
| where now()-firsTime < 86400

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...