Dashboards & Visualizations

I am trying to build a Splunk dashbaord with all the alerts - with details such as last trigger time, alert creation date.- Any help?

amalkapuram
New Member

I tried using |rest command but was unsuccessful in finding last trigger time, alert creation date fields in that. Please help.

Tags (1)
0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

This search should have most of the details you want.

| rest /services/saved/searches

You'll have to join it to the _audit index to find out when they were created though

View solution in original post

0 Karma

mattymo
Splunk Employee
Splunk Employee

Check monitoring triggered alerts http://docs.splunk.com/Documentation/Splunk/6.6.2/Alert/Triggeredalertaction

http://docs.splunk.com/Documentation/Splunk/6.6.2/Alert/Reviewtriggeredalerts

Splunk's built in views should provide some guidance or may achieve what u need.

Also alert manager likely has some nice views once you get deeper into alerting and workflow

https://splunkbase.splunk.com/app/2665/

- MattyMo
0 Karma

jkat54
SplunkTrust
SplunkTrust

This search should have most of the details you want.

| rest /services/saved/searches

You'll have to join it to the _audit index to find out when they were created though

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...