Splunk Search

Triggered Alerts Results

abhi22
New Member

Hello,

I'm looking to get the triggered alert results with alert name and triggered time in one table. Being very simple

Column 1 triggered alert name

Column 2 triggered time

Column 3 Results of the triggered alert

Could anyone help me with this

Thanks in Advance

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

We need more information.  Based on what's in the question, the best we can offer is 

<some search> 
| table AlertName _time AlertResults

Tell us more about the data and we may be able to add some details.

---
If this reply helps you, Karma would be appreciated.
0 Karma

abhi22
New Member

Hello Richgalloway,

I am trying to get the Trigger Alerts dashboard which will show the Alerts which are triggered, I am able to achieve the same using below search query:
index=_audit action=alert_fired ss_app=* | eval ttl=expiration-now() | search ttl>0 | convert ctime(trigger_time) | table trigger_time ss_name severity | rename trigger_time as "Alert Time" ss_name as "Alert Name" severity as "Severity" , Apart from this in another column I also need the results of the triggered alert (events which caused the alert to trigger) or the link which directs to the results of that particular alert . Could you please suggest me on this

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Alert results are not available via SPL because they are not indexed nor does any REST command expose them.

---
If this reply helps you, Karma would be appreciated.
0 Karma

abhi22
New Member

Thank you,

At least when we click on the alert in the dashboard, it should redirect to the results/events which triggered the alert, please suggest if the above is possible and how we can achieve the same

0 Karma

richgalloway
SplunkTrust
SplunkTrust
I don't have a suggestion other than to use the built-in Triggered Alerts dashboard.
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...