Alerting

Where the Alert results are stored in Splunk ?

Communicator

I want to get the results of every triggered alert. For example a particular alert is affecting which hosts in my system and what is the respective message that I am getting for each triggered alert.

Thanks in advance.

0 Karma

Esteemed Legend

Start with this search:

|rest/servicesNS/-/-/alerts/fired_alerts
0 Karma

Super Champion

I believe they are stored in the same place as saved searches.
$SPLUNK_HOME/var/run/splunk/dispatch/search/ folder

Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!