https://docs.splunk.com/Documentation/ES/7.3.1/Admin/Listcorrelationsearches Hi, I'm using the searches mentioned in the documentation. There is a field named triggered_alert_count which gives me what I want but it returns the same number of alerts across all time ranges. | rest splunk_server=local count=0 /services/saved/searches
| rename eai:acl.app as app, title as csearch_name, action.correlationsearch.label as csearch_label, action.notable.param.security_domain as security_domain, triggered_alert_count as number_of_alerts
| search app="SplunkEnterpriseSecuritySuite"
| table number_of_alerts, csearch_label, app, security_domain, description Ideally I would like to see the total number of alerts as far back as Splunk remembers. Thanks.
... View more