add recently triggered alerts to my dashboard

[0range]

Hello.
I'm creating a dashboard and have an idea to place recently triggered alerts on corresponding plot.
It will help to tune alerts and show that they are working good..
Is it possible to do something like this ? And how can I do that?
thanks a lot...

[MuS]

Hi 0range

I use a summary saved search like this:

index=_audit action=alert_fired ss_app=* | eval ttl=expiration-now() | search ttl>0 | convert ctime(trigger_time) | table trigger_time ss_name severity

In the advanced XML dashboard I use a single value graph with rangemap like this:

 <module name="HiddenSearch" layoutPanel="panel_row1_col2" autoRun="True">
            <param name="search"> index=summary search_name="YourSavedSearch" | table trigger_time ss_name severity | stats count | rangemap field=count low=0-0 elevated=1-1 default=severe</param>
            <module name="SingleValue" > 
                <param name="beforeLabel">Overall Status: </param> 
                <param name="afterLabel"> Alerts have been fired</param> 
                <param name="linkFields">result</param>
                <param name="linkView">flashtimeline</param>
                <param name="linkSearch">
                    index=summary search_name="YourSavedSearch" | table trigger_time ss_name severity
                </param>
            </module>
        </module>

hope this helps ...

cheers, MuS