9.3 Viewing Fired Alerts

Finding fired alerts in Splunk Web

Topic 8.5 View fired alerts is operational, not theoretical. When an alert triggers, responders need a single place to see what fired, when, how severe it was, and in what mode. In Splunk Web that place is the Triggered Alerts page, opened from the top navigation:

Activity → Triggered Alerts

Some materials say "fired alerts," "triggered alerts," or "alert manager." On the User exam, map all of those phrases to this Activity view and its listing of recent trigger records.

This section stays User-level: navigate, read columns, open details, acknowledge/manage listings, and know default retention. It does not cover Enterprise Security incident review queues or notable-event frameworks.

---

1. How an alert becomes visible on the page

A trigger record appears on Triggered Alerts when:

1. The alert's search runs (scheduled or real-time).
2. Trigger conditions match (for conditional alerting).
3. The alert is configured to list / add to Triggered Alerts (the monitoring action that records the fire in this UI), and/or your environment's alerting setup records the trigger for display.

If someone expects to see every email-only alert here but never enabled listing in Triggered Alerts, the inbox may fill while the Activity page stays empty. Conversely, listing without email still creates an auditable fire history in the UI.

---

2. Reading the Triggered Alerts listing

The page presents recent fires in columns. Memorize what each category means:

Mode decoded

• Per-result — the fire is associated with triggering on an individual matching result/event path.
• Digest — the fire represents a grouped evaluation for that run (the "trigger once" style summary).

Severity does not change whether the alert fired; it helps you triage the queue when many alerts land at once.

---

3. Alert manager basics: investigate a fire

From the Triggered Alerts page you typically:

1. Filter or sort by time, severity, app, or name to find the incident of interest.
2. Open the fired alert to review details — links to results, search context, and related information depending on configuration.
3. Use those results to validate whether the condition is still active (re-run or drill into the referenced job/results).
4. Decide next operational steps outside Splunk (ticket, restart service, ignore false positive) — User exam stops at knowing the UI path and record meaning.

Practical triage checklist

• Is severity High/Critical or informational noise?
• Is mode per-result flooding the list during a burst?
• Did multiple apps fire related alerts at the same timestamp (correlated operationally, even without ES)?
• Is this a repeat within the throttle window of a noisy alert definition?

---

4. Acknowledge, history, and cleanup

User-level management of fired alerts includes understanding history lifespan and removing listings you do not need to keep on screen.

Default history window

• Triggered alert records are available for 24 hours by default.
• Admins/owners can configure a longer or different lifespan per alert (for example seven days) so important fires remain visible longer.
• After expiration, the listing disappears from the default Triggered Alerts history even though other logging (such as audit events in advanced environments) may still exist — do not assume forever-visible UI history.

Managing listings

Common management actions on the page include:

• View details for a specific fire
• Delete a triggered alert listing from the page when it is acknowledged/handled or is clutter
• Rely on expiration for automatic cleanup when you do not delete manually

"Acknowledge" in study language means you have seen the fire, reviewed it, and cleared or accepted it in the manager — not that Splunk Enterprise Security closed a notable. Keep vocabulary tied to the Triggered Alerts page.

---

5. End-to-end User workflow (create → fire → view)

Connect Domains 8.1–8.5 into one story:

1. Save a monitoring search as an Alert (not a scheduled report) with a result-count trigger.
2. Enable actions: Email + List in Triggered Alerts.
3. Optionally set throttle to 30 minutes and severity to High.
4. When conditions match, recipients get email and a row appears under Activity → Triggered Alerts.
5. Open the row, inspect mode/severity/time, review results, then delete or wait for the 24-hour default expiry.

Exam traps for topic 8.5

• Looking under Settings → Searches, Reports, and Alerts for the fire history — that page manages definitions, not the fired-alert queue.
• Looking only at Reports for trigger history — reports are not the fired-alert manager.
• Assuming every alert appears forever on Triggered Alerts — default visibility is time-bounded (24 hours unless changed).
• Confusing Mode: Digest vs Per-result with alert Type: Scheduled vs Real-time — type is how the search runs; mode describes how that fire was triggered/recorded.

Quick navigation drill

Say this aloud until automatic:

"Definitions live with Searches/Reports/Alerts settings. Fires live under Activity → Triggered Alerts."

That single sentence answers most "where do I view fired alerts?" stems on Splunk Core Certified User.

Finish Domain 8.0 by ensuring you can schedule a report with email, create a conditional alert with throttle, and locate the resulting fires in the Activity manager without drifting into Power User or Enterprise Security tooling.