Splunk Enterprise

How can I retrieve fired alerts in chronological order ?

av81
Engager

Hello,

I used Splunk REST API with Search endpoint to be able to retrieve the latest fired alerts based on a title search.

I get the fired alerts in alphabetical order but not in chronological order since all the alerts obtained have the default field <updated>1970-01-01T01:00:00+01:00</updated>.

Here's the url and query I used :
https://<host>:<mPort>/services/alerts/fired_alerts?search=name%3DSOC%20-*&&sort_dir=desc&sort_key=u...

 

 

| rest /services/alerts/fired_alerts/
| search title="SOC - *"
| sort -updated
| table title, updated, triggered_alert_count, author

 

 

splunk.PNG

Here are the references I used : 
Search endpoint descriptions - Splunk Documentation
Using the REST API reference - Splunk Documentation

So, how can I retrieve fired alerts in chronological order with a title search ? Or how can I obtain a field indicating the date the alert was triggered ?

Thanks in advance.

Labels (2)
0 Karma
1 Solution

marnall
Motivator

You could use the /services/search/v2/jobs REST endpoint

 

| rest /services/search/v2/jobs 
| search label = "SOC - *"
| sort - updated
| table label updated author ```add fields as desired```

View solution in original post

0 Karma

marnall
Motivator

You could use the /services/search/v2/jobs REST endpoint

 

| rest /services/search/v2/jobs 
| search label = "SOC - *"
| sort - updated
| table label updated author ```add fields as desired```
0 Karma
Get Updates on the Splunk Community!

Digital Resilience Assessment Launch | How prepared are you for disruption?

Disruption is inevitable. The question is – how prepared are you to handle it? In today’s fast-moving digital ...

Buttercup Games: Further Dashboarding Techniques (Part 2)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Index This | What is the next number in the series? 7,645 5,764 4,576…

February 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...