Alerting

Where the Alert results are stored in Splunk ?

Communicator

I want to get the results of every triggered alert. For example a particular alert is affecting which hosts in my system and what is the respective message that I am getting for each triggered alert.

Thanks in advance.

0 Karma

Esteemed Legend

Start with this search:

|rest/servicesNS/-/-/alerts/fired_alerts
0 Karma

Super Champion

I believe they are stored in the same place as saved searches.
$SPLUNK_HOME/var/run/splunk/dispatch/search/ folder