List correlation searches with number of alerts

[PleaseHelp]

https://docs.splunk.com/Documentation/ES/7.3.1/Admin/Listcorrelationsearches

Hi, I'm using the searches mentioned in the documentation. There is a field named triggered_alert_count which gives me what I want but it returns the same number of alerts across all time ranges. 

| rest splunk_server=local count=0 /services/saved/searches
| rename eai:acl.app as app, title as csearch_name, action.correlationsearch.label as csearch_label, action.notable.param.security_domain as security_domain, triggered_alert_count as number_of_alerts
| search app="SplunkEnterpriseSecuritySuite"
| table number_of_alerts, csearch_label, app, security_domain, description

Ideally I would like to see the total number of alerts as far back as Splunk remembers. Thanks.

[marysan]

Hi
I suppose that this query works for you :

index=notable
| stats count as alert_num by rule_name
| rename rule_name as csearch_label
| lookup savedsearches csearch_label as csearch_label OUTPUTNEW action.notable.param.security_domain as security_domain, description, eai:acl.app as app
| search app="SplunkEnterpriseSecuritySuite"
| table alert_num, csearch_label, app, security_domain, description | sort - alert_num

[ITWhisperer]

As the documentation says, the ReST API that you are using returns information about the search (definition). These are not events and do not have timestamps (per se), so you are getting all the definitions already.

[PleaseHelp]

Thanks @ITWhisperer do you know how I could obtain this information? 

[ITWhisperer]

You could try something like this

| rest /servicesNS/-/-/alerts/fired_alerts