I am trying to build a Splunk dashbaord with all the alerts - with details such as last trigger time, alert creation date.- Any help?

[amalkapuram]

I tried using |rest command but was unsuccessful in finding last trigger time, alert creation date fields in that. Please help.

[mattymo]

Check monitoring triggered alerts http://docs.splunk.com/Documentation/Splunk/6.6.2/Alert/Triggeredalertaction

http://docs.splunk.com/Documentation/Splunk/6.6.2/Alert/Reviewtriggeredalerts

Splunk's built in views should provide some guidance or may achieve what u need.

Also alert manager likely has some nice views once you get deeper into alerting and workflow

https://splunkbase.splunk.com/app/2665/

[jkat54 · Accepted solution]

This search should have most of the details you want.

| rest /services/saved/searches

You'll have to join it to the _audit index to find out when they were created though