Hi folks,
Looking to use es_notable_events as a way of building out a panel that will get info on ES events for the past 7 days, specifically how many alerts were closed by the team and what the alert name is. The search I am using is as follows:
| `es_notable_events` | search timeDiff_type=current | stats sparkline(sum(count),30m) as sparkline,sum(count) as count by rule_name | sort 100 - count | table rule_name, count
This works perfectly for the past 48 hours but it doesn't go back as far as a week (a known limitation when using es_notable_events apparently!). My question is, are there any altenative searches that I can run that will get these results?
