Export list of triggered alerts

[ovidiupp]

How do I export of list of triggered alerts in a CSV for a certain period of time from Splunk Cloud? This should be something like the view on the Activity>Triggered Alerts screen? The important fields are triggered time and title of alert.

Thank you.

[richgalloway]

There's no single request to get that information.  You can use a REST call to get a list of alerts that triggered and then use that to search the internal indexes for details.  Perhaps this query will get you started.

index=_internal [
  | rest /servicesNS/-/-/alerts/fired_alerts/ 
  | rename title as savedsearch_name 
  | return 1000 savedsearch_name] result_count!=0
| table savedsearch_name _time