Splunk Search

Counting how many times alerts have been triggered

New Member


For comparison purposes I'd like to determine how many times each of our alerts have been triggered. Is this information available somewhere, hopefully via a search?

Thanks a lot

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

As I wrote in another post:

You can start with searching for the _internal index for alert_actions field data:

index=_internal alert_actions="*"

This will get you the raw data.

To count the times an alert has been triggered and get a list of which searches they are, use:

index=_internal alert_actions="*" | top alert_actions,savedsearch_name limit=0


Jesse Trucks
Minister of Magic
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...