How to make a report of details about all savedsearch that fire in a day?

[phamxuantung]

I want to make a report about how many alerts fired in a day. I saw in the job inspection

I want all of these info, owner, apps, event, size and runtime. It's to determine how many alert overlapping each other, how many times that alert triggered. Prefer in SPL.

Basically, I want for these information to help me make a detail report about alerts in our system.

[isoutamo]

Hi

you could find some solutions from community by searching with Google. Here is one example

index=_internal sourcetype=scheduler search_type=scheduled alert_actions!="" alert_actions!="summary_index"
| table savedsearch_name, sid, app, alert_actions, scheduled_time, *time

Just update table part to get your needed columns and/or add other queries if that one event didn't  contain all needed fields.

r. Ismo