Export list of triggered alerts

New Member

How do I export of list of triggered alerts in a CSV for a certain period of time from Splunk Cloud? This should be something like the view on the Activity>Triggered Alerts screen? The important fields are triggered time and title of alert.

Thank you.

Labels (1)
0 Karma


There's no single request to get that information.  You can use a REST call to get a list of alerts that triggered and then use that to search the internal indexes for details.  Perhaps this query will get you started.

index=_internal [
  | rest /servicesNS/-/-/alerts/fired_alerts/ 
  | rename title as savedsearch_name 
  | return 1000 savedsearch_name] result_count!=0
| table savedsearch_name _time
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...