How to find the most use cases trigger alerts in S... - Splunk Community

Splunk Enterprise Security

Greetings!

I need to know how I can find the most use cases trigger alerts in Splunk.

is there any specific search query that can help? I need the use case name and the count of the alerts

See if this query helps.

| rest /servicesNS/-/-/saved/searches splunk_server=local 
```Ignore reports and disabled searches```
| search alert_type!="always" disabled=0 
| where triggered_alert_count > 0 
| table title eai:acl.owner eai:acl.app triggered_alert_count

---
If this reply helps you, Karma would be appreciated.

Get Updates on the Splunk Community!

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...