Splunk Search

How do you search by specific alert type?

wzgoda
Explorer

Hey,

I was looking run a historical search for a specific alert over a period of time. What search can I run in order to search by alert type?

0 Karma
1 Solution

Raghav2384
Motivator

This should have all the information you want:

index=_internal host=* source=*scheduler.log

Best bet, s.o.s (Splunk On Splunk Application)

Built in: From you splunk web, upper right hand corner, click on - Activity > System Activity > Scheduler > Scheduler Activity by Saved search. This should give you any & all the information you need.

Also, hit the following endpoints:

|rest /services/alerts/alert_actions
|rest /services/alerts/fired_alerts
|rest /services/saved/searches

Hope this helps!

Thanks,
Raghav

View solution in original post

Raghav2384
Motivator

This should have all the information you want:

index=_internal host=* source=*scheduler.log

Best bet, s.o.s (Splunk On Splunk Application)

Built in: From you splunk web, upper right hand corner, click on - Activity > System Activity > Scheduler > Scheduler Activity by Saved search. This should give you any & all the information you need.

Also, hit the following endpoints:

|rest /services/alerts/alert_actions
|rest /services/alerts/fired_alerts
|rest /services/saved/searches

Hope this helps!

Thanks,
Raghav

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.