Alerting

Where the Alert results are stored in Splunk ?

sandyIscream
Communicator

I want to get the results of every triggered alert. For example a particular alert is affecting which hosts in my system and what is the respective message that I am getting for each triggered alert.

Thanks in advance.

0 Karma

woodcock
Esteemed Legend

Start with this search:

|rest/servicesNS/-/-/alerts/fired_alerts
0 Karma

cmerriman
Super Champion

I believe they are stored in the same place as saved searches.
$SPLUNK_HOME/var/run/splunk/dispatch/search/ folder

Get Updates on the Splunk Community!

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...