trace source IP or instance for blank alert

[Andrew Lebbon]

Hi All,

Whats the best way to find out the source IP or instance name for a blank alert in alertmanger triggered from a rule? I have been looking at the NFLOG but part of is is encoded and Ive had trouble viewing this. I was hoping there is a better way to get at the source of a historical alert ?

thanks

Andrew Lebbon