Alerting

How can I get the creation-date of alerts?

anilkumaryadav
New Member

Hi,

I have searched across the answers community and came to know that updated can give nearby datetime when alert was last modified. But I want to get a list of alerts with creator, creation-date.
Is there any way to achieve it?

Thanks,
Anil

Tags (2)
0 Karma

vinaybandaru
Path Finder

Hi @anilkumaryadav ,

I don't know if it is correct but you can try with below query if i'm not wrong if you have the data retention for _audit index that covers the creation time of alerts.

index=_audit ss_name "alertname" action=search | dedup source sortby +_time | table _time,user

Thanks,
Vinay

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...