Alerting

Alert History

spiced
New Member

How can I get an alert history? We have some alerts configured and currently there are many false positives. In order to reduce them we will fine tune the alerts. But we would like to have a history of the tuning. Is it possible to see how the alerts have changed over time?

0 Karma

dindu
Contributor

Hi,

You could get some information from the Splunk internal logs.

Use the below query to fetch the details.

     index=_internal source="/opt/splunk/var/log/splunk/scheduler.log" savedsearch_name="your_search_name".

If it does not return any result - remove the conditions and try searching again like below.

  index=_internal "your_search_name"

The details you will get depends on the retention of the saved search logs.
Please let us know whether this helped.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You can go to Activity->Triggered Alerts to see the when alerts fired. There is not, however, a history of how the alerts were defined in the past. You'll have to do that yourself, perhaps using something like git.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...