Thank you, At least when we click on the alert in the dashboard, it should redirect to the results/events which triggered the alert, please suggest if the above is possible and how we can achieve the same ... View more

Hello Richgalloway, I am trying to get the Trigger Alerts dashboard which will show the Alerts which are triggered, I am able to achieve the same using below search query: index=_audit action=alert_fired ss_app=* | eval ttl=expiration-now() | search ttl>0 | convert ctime(trigger_time) | table trigger_time ss_name severity | rename trigger_time as "Alert Time" ss_name as "Alert Name" severity as "Severity" , Apart from this in another column I also need the results of the triggered alert (events which caused the alert to trigger) or the link which directs to the results of that particular alert . Could you please suggest me on this ... View more