Overview

Alerts 2.0 is a comprehensive alert management system that enables you to efficiently query, interpret, and act on alerts using OpsQL. This guide explains the key features and workflows available in Alerts 2.0.

Key Features

With Alerts 2.0, you can:

• Search for alerts using OpsQL, and save or share your views.

  Note

  When you select a specific client for alert queries, only alerts for that client are displayed.
• View alert summaries in a slide-out panel for quick reference.
• Take actions on alerts directly from the slide-out panel.
• Perform bulk actions on multiple alerts.
• Set a refresh interval from 1 minute to 24 hours.
• Service Provider users can search for alerts across all clients within All Partners.

Alerts Column Settings

You can customize the alert listing by selecting alert and resource attributes from the Column Settings popup.

To add or remove columns:

1. Click the Settings icon in the upper-right corner of the alerts listing screen to view available attributes.

2. Search for the desired attribute.

3. Click Update. The listing updates accordingly.
4. The selected attribute appears as a column. Scroll right to view additional columns.

Updated Attribute Names:

• Heal Time is now Alert Critical Warning Duration.
• Created Time is now Triggered Time.

Manage External Ticket IDs

You can track and manage external ticket IDs directly from the Alert Browser:

• Filter Using OPSQL: Use the extTicketId attribute in your queries to find alerts linked to external tickets.

  Note

  Use the contains operator with `extTicketId` in OPSQL queries.
  

• Add as a Column: Add the External Ticket ID field via column settings for quick access. See Alerts Column Settings.
• View Multiple IDs: If an alert is linked to multiple tickets, all IDs are shown as comma-separated values.

Alert Email Notification

Alert email notifications now redirect to the new Alerts page. Actions such as Acknowledge and Suppress from escalation emails open directly in the new alert details page with the action applied.

Filtering Alerts

Use OpsQL to build custom queries for filtering and analyzing alert data. Queries consist of attributes, operators, and values, allowing you to define precise conditions (e.g., severity, state, source, timestamps). Combine multiple conditions using logical and comparison operators.

Filter by Comments

You can filter alerts based on comments and the timestamp of the last comment.

Supported Attributes:

• comment.description: Search for keywords or phrases in alert comments.
• lastCommentDate: Filter alerts by the date/time of the last comment.

Filter by Suppression Duration

You can filter suppressed alerts by duration and time period using OpsQL.

• Suppressed for a specific duration (in minutes):

  createdTime > -30d AND suppressDurationMins = 5
  

  Note

  Suppression duration in hours is not directly supported. Convert hours to minutes and use `suppressDurationMins`.
  

  Example: To search for 2 hours:
  createdTime > -30d AND suppressDurationMins = 120

• Suppressed permanently:

  createdTime > -30d AND suppressDurationMins = 0 AND status = 'Suppressed'
  

• Suppressed between specific dates/times:

  status = 'Suppressed' AND statusHistory.suppressedTime > '2025-03-10T10:05:00+0000' AND statusHistory.suppressedTime < '2025-03-11T10:05:00+0000'
  

Alerts Slide-Out

The Alerts Slide-Out provides a summary of an alert.

To view the slide-out:

1. Click the Alert ID in the listing page.
   By default, open and acknowledged alerts from the last 7 days are shown.
   For query building, see How to build queries.

Slide-Out Information:

• Current alert status, state, and ID
• First and last alert times
• Total occurrences (repeat count), inference, and correlation details
• Alert type, resource, metric, component, client, description, resource type
• Last comment
• View Details for more information
• ACTIONS button for alert actions:

Acknowledge an Alert

Acknowledging an alert confirms you have seen and are aware of it. This helps ensure critical issues are addressed and clarifies responsibility among team members.

To acknowledge:

1. Select an alert in the browser. The slide-out appears.
2. Click Actions.
3. Select Acknowledge.

4. Enter comments.

5. Click ACKNOWLEDGE. The alert is acknowledged.

You can view the last acknowledged user and comments in the ACTIVITY LOG tab.

Create Incident

1. Go to the Alerts page.
2. Select an alert. The slide-out appears.
3. Click Actions.
4. Select Create incident.
5. Enter incident details and click Save.

The incident number appears in the “incidentId” column. Click it to view or modify the incident.

Suppress an Alert

1. Go to the Alerts page.
2. Select an alert. The slide-out appears.
3. Click Actions.
4. Select Suppress.
5. Set the suppress duration and enter comments.
6. Click SUPPRESS.

Create Inference

Creating an inference groups related alerts into a single event, helping identify root causes.

1. Go to the Alerts page.
2. Select multiple alerts.
3. Click Actions > Create Inference.

4. On the Create Inference Alert page, enter:
   • Alert to be Inference: List of selected alerts (ID, Created Time, Subject)
   • Subject: Enter a summary (use $ for dynamic fields)
   • Description: Add details (use $ for dynamic fields)
5. Click CREATE INFERENCE.

Merge Inferences

You can merge multiple child inferences (Open or Acknowledged) into a manually created Master Inference Alert.

1. Go to the Alerts page.

2. Select multiple child inferences.

   Note

    To list manually created inferences, use:  
    `isInferenceAlert = "true" AND correlationPolicyId IS NULL`
   

3. Click Actions > Attach Inference.

4. Select the master inference to attach the selected child inferences.

5. Click ATTACH INFERENCE.

Export Alerts

Export alerts from the Alerts 2.0 page as a report.

Prerequisite: The Alert Listing app must be installed.

To export:

1. Select a client from All Clients.
2. Use OpsQL to search for alerts.
3. Click the Export icon next to Filters.

 - If the app is not installed, click **Install App**.
 - The Alert Listing app opens with your filter criteria pre-filled.
 - The export process starts automatically.

4. Click the Recent icon in Configure Parameters to view progress.

How to Build Queries

Build queries using Basic or Advanced modes. Both modes provide dynamic lists of attributes, operators, and values.

For Basic Users

The Basic Query mode lets you build queries without knowing the syntax.

To build a query:

1. Click Command Center > Alerts.
2. By default, Open and Acknowledged alerts from the last 7 days are shown.
3. Click +QUERY to start.
4. Select an attribute, operator, and value.

5. Click + to add more expressions.
6. The AND operator is selected by default; change if needed.

7. Continue adding expressions as needed.

• To create a new tab, click +.
• To delete a query, click X.
• Click REFRESH to update results. Set refresh duration from 1 minute to 24 hours (default: 15 minutes). Click Off to disable auto-refresh.

For Power Users

Advanced Query mode allows direct entry of OpsQL queries.

To use Advanced mode:

1. Click Command Center > Alerts.

2. Click the Advanced Query mode icon.
3. Start typing an attribute in the Search box; matching attributes appear.

4. Select the attribute, operator, and value.

5. Select logical operators (AND or OR).

6. Add more expressions as needed.
7. Click the search icon or press Enter to run the query.

You can switch between Basic and Advanced modes at any time.

For more on OpsQL, see Query Language Reference.

Alert Filters

You can apply the following filters in Alerts 2.0:

Inline Filter

The Inline filter lets you add a cell value as an additional filter. For example, clicking the filter icon next to a metric filters results by that metric.

View Resource Custom Attributes as Alert Tags

Resource-level custom attributes marked as Alert Tags are automatically reflected in alerts from those resources, improving visibility and filtering.

Filtering Using Resource Tags:
Use alert tags in OPSQL queries to filter relevant alerts.

Viewing Alert Tags:

1. On the Alerts page, select an alert.
2. In the alert details, go to the CUSTOM ATTRIBUTES tab.
3. Under ALERT TAGS, view all resource custom attributes marked as alert tags.

Correlated and Inference Alert Icons

You can identify Correlated and Inference alerts by icons in the Alerts 2.0 page. To identify the correlated and inference alerts, hover over the icon next to the Alert ID, on the Alerts 2.0 page.

De-Correlate Alerts

You can de-correlate one or more correlated alerts from the Alerts 2.0 page.

To de-correlate:

1. Select correlated alerts.

2. Click Actions.

3. Select De-Correlate from the drop-down list.

4. The DE-CORRELATE ALERTS slide-out page is displayed.

5. Enter the comments and click DE-CORRELATE.
   The correlated alert is de-correlated.

My Alerts Views

Access the My Alerts Views slide-out by clicking the hamburger menu at the upper-left of the Alerts page.

Available actions:

• Save a View
• Set Favorite
• Restore
• Rename
• Copy
• Set Default View
• Share
• Remove

Save a View

Save query results as a view for future use.

To save:

1. Click the hamburger menu.
2. Click the + icon. The SAVE VIEW popup appears.

3. Enter a name and click ADD.

• Use up/down arrows to show/hide views.
• Save and Restore icons appear after creating a view.
• Click the three dots next to a view for more actions.

Set Favorite

To mark a view as favorite:

1. Search for the view.
2. Hover over the view name.

3. Click the star icon. The view appears under FAVORITE. Click again to remove from favorites.

Restore

Restore reverts a view to its previous query.

1. Hover over the view name.
2. Click the actions menu.
3. Click Restore. The previous query appears in the Search box.

Note: Do not save changes before restoring, or the query will not revert.

Rename

To rename a view:

1. Hover over the view name.
2. Click the actions menu.
3. Click Rename.
4. Enter a new name and click SAVE.

Copy

To copy a view:

1. Hover over the view name.
2. Click the actions menu.
3. Click Copy.
4. Enter a name and click SAVE.

Set Default View

Set a view as the default for the current user.

1. Hover over the view name.

2. Click the actions menu.

3. Click Set Default View.

4. Enable My Default View and click SET DEFAULT.

5. Refresh the browser to see the default view.

To set as default for others, share the view and set it as default for the desired user.

Share

Share a view with specific partner or client roles.

1. Hover over the view name.
2. Click the actions menu.
3. Click Share.

   

4. Select a role and click SHARE.

Notes:

• The view is available to users with assigned roles.
• Partners can share with both partners and clients; clients can share only with clients.
• Views can be shared with multiple roles.
• Users can assign a default view to others by sharing it.

Remove

To remove a view:

1. Hover over the view name.
2. Click the actions menu.
3. Click Remove and confirm.

Alerts Details Page

The Alerts Details page provides a comprehensive view of each alert and allows you to:

• View alert information
• Perform actions such as create/attach incidents, view history, and resource alerts

To access:

1. Click Command Center > Alerts.

   

2. Click the Alert ID. The slide-out appears.
3. Click View details.

   

Details and Actions:

Examples

Log Alert Visualization

Displays log alerts and their inputs. The log time range is shown and links to the logs page.

Filter: alertType = LOG

Change Detection Alert Visualization

Shows alert definition or template name for lower, upper, and average values. Clicking Definitions redirects to the Alerts page.

Filter: alertType = Change_Detection

Monitoring Alerts Visualization

Displays alert definition or monitoring template name. Alerts from Alert Definition use PromQL.

Filter: alertType = Monitoring

Integration Alerts Visualization

For integration object types, only integration data is shown.

Filter: Object Type = Integration

View Historical Alert Comments

Enable the Include Alert Comment History checkbox on the alert details page to view previous comments for alerts that have reappeared on the same Host, Metric, and Component. You can also use the Search icon in the to quickly find specific comments.

Use Case:
Quickly access historical comments for recurring alerts to understand past troubleshooting actions.

To enable:

1. Select an alert to view details.
2. Scroll to the Alert Log section.
3. Select Include Alert Comment History.
   Up to the last 200 comments from historical alerts are displayed.

Related Topics

Infrastructure Search