Top alerts fires

saotaigiri · ‎09-10-2020

Please I am looking for a query to search for the top alerts that fired within 2 weeks (or within a time frame).

I am also looking for a query to show anomalies within a time frame

richgalloway · ‎09-10-2020

Start with this query.

| rest/servicesNS/-/-/alerts/fired_alerts| search NOT title="-"

Your second question is far too broad to attempt to answer. Please post a new question with more specifics. What kind of data? What is considered an anomaly? What time frame?

---
If this reply helps you, Karma would be appreciated.

Top alerts fires

using Enterprise Security

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Network to App: Observability Unlocked [May & June Series]

SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

Join the Conversation

Top alerts fires

using Enterprise Security

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Network to App: Observability Unlocked [May & June Series]

SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions