Top alerts fires

saotaigiri · ‎09-10-2020

Please I am looking for a query to search for the top alerts that fired within 2 weeks (or within a time frame).

I am also looking for a query to show anomalies within a time frame

richgalloway · ‎09-10-2020

Start with this query.

| rest/servicesNS/-/-/alerts/fired_alerts| search NOT title="-"

Your second question is far too broad to attempt to answer. Please post a new question with more specifics. What kind of data? What is considered an anomaly? What time frame?

---
If this reply helps you, Karma would be appreciated.

Top alerts fires

using Enterprise Security

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

May 2026 Splunk Expert Sessions: Security & Observability

Network to App: Observability Unlocked [May & June Series]

Join the Conversation

Top alerts fires

using Enterprise Security

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

May 2026 Splunk Expert Sessions: Security & Observability

Network to App: Observability Unlocked [May & June Series]