Counting how many times alerts have been triggered

[ajmills]

Hello--

For comparison purposes I'd like to determine how many times each of our alerts have been triggered. Is this information available somewhere, hopefully via a search?

Thanks a lot

[jtrucks]

As I wrote in another post:

You can start with searching for the _internal index for alert_actions field data:

index=_internal alert_actions="*"

This will get you the raw data.

To count the times an alert has been triggered and get a list of which searches they are, use:

index=_internal alert_actions="*" | top alert_actions,savedsearch_name limit=0

Cheers,
Jesse