basically. I'm looking to extract the data from the triggered alerts drop down menu --under activity into a panel on a dashboard
Basically, a triggered alert is a scheduled search job that ran an alert action. These are mentioned here:
index=_internal sourcetype=scheduler status=success alert_actions=*
Depending on the alert there might be more logs, e.g. about sending out an email. Go poke around the _internal index.
Basically, a triggered alert is a scheduled search job that ran an alert action. These are mentioned here:
index=_internal sourcetype=scheduler status=success alert_actions=*
Depending on the alert there might be more logs, e.g. about sending out an email. Go poke around the _internal index.