Where the Alert results are stored in Splunk ?

sandyIscream · ‎06-03-2017

I want to get the results of every triggered alert. For example a particular alert is affecting which hosts in my system and what is the respective message that I am getting for each triggered alert.

Thanks in advance.

woodcock · ‎06-03-2017

Start with this search:

|rest/servicesNS/-/-/alerts/fired_alerts

cmerriman · ‎06-03-2017

I believe they are stored in the same place as saved searches.
$SPLUNK_HOME/var/run/splunk/dispatch/search/ folder

Where the Alert results are stored in Splunk ?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

Join the Conversation

Where the Alert results are stored in Splunk ?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...