Alerts 2.0 provides a comprehensive overview of your alert management system.

Powered by OpsQL, you can query, interpret, and act on the alerts.

With Alerts 2.0, you can do the following:

• Search for queries using OpsQL, save, and share the views.

  Note

  If you select a specific client to search for alert queries, only those specific client queries are displayed.

• View a summary of the specific alert in a slide-out panel for quick reference.

• Perform actions on the alert from the slide-out panel.

• Perform bulk actions on multiple alerts.

• Select a refresh duration from 1 minute to 24 hours.

• The New Alert listing page supports Service Provider context. Service Provider users can search for alerts across all clients within All Partners.

Alerts Column Settings

You can select alert attributes and resource attributes for listing from the Column Settings popup window.

Follow these steps to add or remove a column:

1. Click the Settings icon available on the upper-right corner of the alerts listing screen to view a list of alert attributes including resource attributes.

   

2. Search for the alert attribute or resource attribute.

   

3. Click Update. The Alerts listing page is updated accordingly.

4. The alert/resource attribute is added as a column in the list.
   Scroll to the right of the screen to view the column(s).

Updated attribute names

The below attribute names in the new alerts browser of the alert listing page have been changed:

• Heal Time is now labeled as Alert Critical Warning Duration.
• Created Time is now labeled as Triggered Time.

Manage External Ticket IDs

You can now track and manage external ticket IDs directly from the Alert Browser by:

• Filter Using OPSQL: Use the extTicketId attribute in your OPSQL queries to filter alerts based on external ticket IDs. This helps in quickly locating alerts tied to specific external incidents.

  Note

  To search alerts using the extTicketId attribute in OPSQL, use the contains operator.
• Add as a Column: Customize your Alert Browser view by adding the External Ticket ID field through the column settings. This provides quick access to ticket mappings without drilling into individual alert details. See Alerts Column Settings for more details about column settings.
• View Multiple IDs: If an alert is linked to multiple external tickets, all associated IDs are displayed as comma-separated values in the column, making it easy to match with incident management systems.

Alert Email Notification

Email notification links for alerts now redirect to the new Alerts page instead of the classic view. Actions like Acknowledge and Suppress from escalation emails will also open directly in the new alert details page with the selected action applied.

Filter Alerts

You can use OpsQL to build custom queries that filter and analyze alert data effectively. Each query consists of attributes, operators, and values, allowing you to define precise conditions such as severity, alert state, source, and timestamps.

You can combine multiple conditions using logical operators and apply comparison operators to refine your search.

Filter alerts by Comments

You can use OpsQL to search and filter alerts based on comments and the timestamp of the last comment.

Supported Attributes

• comment.description: Use this field to search for specific keywords or phrases within alert comments.
• lastCommentDate: Use this field to filter alerts based on the date and time when the last comment was added to the alert.

Filter alerts by Suppression Duration

You can now use OpsQL queries in the Alerts Browser to search for suppressed alerts based on duration and specific time periods.

The following filters have been added to help users search and analyze suppressed alerts more effectively:

• Filter alerts suppressed for a specific duration (in minutes): "filterCriteria": "createdTime > -30d AND suppressDurationMins = 5"

  Note

  Searching by suppression duration in hours is not directly supported. You must convert hours into minutes and use the suppressDurationMins field.
  Example workaround:
  To search for alerts suppressed for 2 hours:
  "filterCriteria": "createdTime > -30d AND suppressDurationMins = 120"
  
• Filter alerts suppressed permanently:
  "filterCriteria": "createdTime > -30d AND suppressDurationMins = 0 AND status = 'Suppressed'"
• Filter alerts suppressed between specific dates and times:
  "filterCriteria": "status = 'Suppressed' AND statusHistory.suppressedTime > '2025-03-10T10:05:00+0000' AND statusHistory.suppressedTime < '2025-03-11T10:05:00+0000'"
  This returns all alerts that were suppressed between March 10th, 10:05 AM UTC and March 11th, 10:05 AM UTC.

Alerts Slide-Out

You can view the summary of an alert on the Alerts Slide-Out.

To view the Alerts slide-out:

1. Click the Alert ID on the Alerts listing page.
   By default, the open and acknowledged alerts for the last seven days are displayed.
   To learn how to build queries, click here.

The alerts slide-out has the following information:

• The current Alert status, alert state and Alert ID information is displayed along with the alert subject.
• The First alert time and Last alert time information
• Total occurrence (repeat count) of the alert, Inference, Correlated (The Inference information appears if it is a correlated alert. The Correlated information appears if it is an inference alert. Click the respective links to get the details.)
• Information like Alert Type, Resource, Metric, Component, Client, Alert Description, Resource Type.
• Last Comment information
• Show More: Click View Details to view the alert details.
• ACTIONS: Use the ACTIONS button to perform the following actions on an alert:
  

Acknowledge an alert

Acknowledging an alert typically means that you confirm that you have seen and are aware of the alert. When an alert is generated, it requires some action or attention from a user. Acknowledging alerts helps ensure that critical issues are not overlooked and appropriate actions are taken on time to address them. It also helps facilitate communication and coordination among team members by providing clarity on who is responsible for handling each alert.

To acknowledge an alert:

1. Select an alert from the alerts browser.
   The slide-out is displayed.

2. Click Actions from the slide-out.

3. Select Acknowledge from the list.
   The ACKNOWLEDGE ALERTS page is displayed.

   

4. Enter the comments under Comments section.

   

5. Click ACKNOWLEDGE.
   The alert is acknowledged.
   

   You can access the details of the last acknowledged user and leave comments directly from the ACTIVITY LOG tab within the slide-out.

   

Create incident

1. Navigate to the Alerts page.
2. From the list, select an alert for which you want to create an incident.
   The slide-out is displayed.
3. Click Actions from the slide-out.
4. Select Create incident from the list.
   The create incident page is displayed.
5. Enter the incident details and click Save.
   The incident is created.
   

You can find the incident number in the “incidentId” column. By clicking on the incidentId, you can access the details of the corresponding incident in the alert slide-out window. From there, you can modify the incident and take further action.

Suppress an Alert

1. Navigate to the Alerts page.
2. From the list, select an alert which you want to suppress.
   The slide-out is displayed.
3. Click Actions from the slide-out.
4. Select Suppress from the list.
   The SUPPRESS ALERTS page is displayed.
5. Select the suppress duration and enter your comments.
   
6. Click SUPPRESS.

Create Inference

Creating an inference allows you to group multiple related alerts into a single, meaningful event. This helps in identifying the root cause more efficiently by analyzing patterns across alerts that may originate from the same resource or services.

1. Navigate to the Alerts page.

2. From the list, select multiple alerts that you want to create inference.

3. Click Actions.

4. Select Create Inference from the list.
   The Create Inference Alert slide-out is displayed.
   

   

5. On the Create Inference Alert page, enter below information:
   

   • Alert to be Inference: This section displays the list of alerts you’ve selected to be part of the inference. Each alert is shown with its:
     • ID
     • Created Time
     • Subject
   • Subject: Enter a summary or title for the inference. You can use $ to insert a dynamic field reference.
   • Description: Provide additional details about the inference. This can include the context, suspected root cause, or any relevant information. Like the subject, you can use $ to insert field references.

   • Click CREATE INFERENCE.
     The inference is now created.

Merge Inferences

You can now merge multiple child inferences with a status of Open or Acknowledged into a manually created Master Inference Alert directly from the Alert Browser. This feature helps reduce noise by grouping related inferences under a single master alert, improving incident investigation and resolution workflows.

1. Navigate to the Alerts page.

2. From the list, select multiple child inferences that you want to merge.

   Note

   To retrieve a list of manually created inference alerts, you can use the following OPSQL query in the Alert Browser:
   isInferenceAlert = "true" AND correlationPolicyId IS NULL

3. Click Actions.

4. Select Attach Inference from the list.
   The Attach Inference Alert slide-out is displayed.
   

   

5. On the Attach Inference Alert page, select the manually created master inference to which you want to attach the selected child inferences.

6. Click ATTACH INFERENCE.

Export

The Export functionality lets you to export the response alerts from the Alerts 2.0 page as a report.

Prerequisite: The Alert Listing app should be installed.

To export alerts filter criteria:

1. From All Clients, select a client.

2. On the Alerts 2.0 page, use the search option to search for alerts using the OpsQL query.
   The Search results are displayed.

3. Click the Export icon available next to the Filters option.
   A message asks the user to install the Alert Listing app if it is not already installed. Click Install App to install the app.

   

   The page is redirected to the Alert Listing app screen.
   The configuration properties in the Alert Listing app are auto-filled with the filter criteria that were provided in the search.
   The run process is initiated. The process progress depends on the data and the configuration parameters.

4. Click the Recent icon available in the Configure Parameters section to view the progress.

How to build queries

Build queries using the basic and advanced query modes. The query modes have attributes, logical operators, and values that are dynamically populated. Select these parameters to form valid expressions and complete building the queries.

The following sections describe the steps that both the basic and advanced users should follow for building the queries:

Basic users - See for Basic Users section.

Power users - See for Power Users section.

For Basic Users

A beginner can start querying using the Basic Query mode. The Basic Query mode allows you to create a query without knowing the exact syntax.

To build a query:

1. Click Command Center > Alerts. The ALERTS query page is displayed.

2. By default, the Open and Acknowledged alerts that have been updated within the last 7 Days are displayed. To clear the query, click the close X icon.

3. To start building a query, click +QUERY. The ATTRIBUTES list is populated.

4. Select an attribute and then select an operator from the OPERATORS drop-down that is dynamically populated.

   

5. Select a value from the VALUES drop-down. The values are populated based on the selected attribute and operator. The query result is displayed.

   

6. Click + to add another expression.

7. The AND logical operator is selected by default. Click and select the desired operator.

   

8. Follow the steps mentioned above to form another expression – attribute, operator and value.

The query result is displayed.

The following additional actions can be performed:

• To create a new tab, click +.

• To delete a query, click X.

• Click REFRESH to refresh the query result list. You can set the refresh duration from 1 Minute to 24 Hours. The default is set to 15 Minutes. Click Off if you do not want to refresh the query result list.

For Power Users

As a power user you can go ahead and use the Advance Query mode.

To start querying:

1. Click Command Center > Alerts. The ALERTS query page is displayed.

   

   By default, the Open and Acknowledged alerts that have been updated within the last 7 Days are displayed on the Alerts page. To clear the query, click the close X icon.

2. Click the Advance Query mode icon to switch to the Advance query mode.

3. As soon as you start typing the attribute name in the Search box, the available attributes are displayed automatically.

   

4. Select the attribute and the operator from the dynamically populated matching operator list and then type in (or select) a value.

   

5. Select the logical operators, AND or OR

   

6. Follow the steps mentioned above – select the attribute, operator and value to form an expression. You can add as many valid expressions as possible.

7. Click the search icon or hit enter. The query result is displayed.

You can click the Basic Query mode icon to switch to the Basic Query mode.

Switch between Basic and Advanced Query modes at any time

• You can switch between the Basic and the Advanced Query modes anytime without making any changes to the query.

For more information on the OpsQL Query Language and examples, click here.

Alert filters

The following filters can be applied to alerts using Alerts 2.0:

Inline filter

The Inline filter allows users to add the value of a cell as an additional filter. In the following example, clicking the filter icon filters the results of the table, where the metric is CPU.

View Resource Custom Attributes as Alert Tags

Custom attributes defined at the resource level and marked as Alert Tags are now automatically reflected in alerts triggered by those resources. This feature improves alert visibility and filtering by bringing key resource context into the alert view.

Filtering Alerts Using Resource Tags
You can also use these alert tags in OPSQL queries to filter relevant alerts as shown below:

In the image above, the OPSQL query filters all alerts where the custom attribute Extension has the value http://test.com.

Where to View Alert Tags

1. On the Alerts page, select the alert for which you want to view the associated alert tags.

2. On the alert details page, select CUSTOM ATTRIBUTES tab.

3. Under the ALERT TAGS section, you will see all resource custom attributes that are marked as alert tags.
   These tags mirror the values defined on the impacted resource.

   

The custom attributes attr and Extension are tagged at the resource level.

Correlated and Inference Alert Icons

You can identify Correlated and Inference alerts by icons in the Alerts 2.0 page. To identify the correlated and inference alerts, hover over the icon next to the Alert ID, on the Alerts 2.0 page.

De-Correlate Alerts

You can de-correlate a single or multiple correlated alerts from the ALerts 2.0 page.

To de-correlate an alert:

1. In the Alerts 2.0 page, select a single or multiple correlated alerts that you want to de-correlate.

2. Click Actions.

3. Select De-Correlate from the drop-down list.

4. The DE-CORRELATE ALERTS slide-out page is displayed.

5. Enter the comments and click DE-CORRELATE.
   The correlated alert is de-correlated.

   

My Alerts Views

To navigate to the My Alerts Views slide-out:

1. Click the hamburger menu icon at the upper-left corner of the Alerts page, to view the My Alerts Views slide-out.

   

You can perform the following actions from the My Alerts Views slide-out:

• Save a View
• Set Favorite
• Restore
• Rename
• Copy
• Set Default View
• Share
• Remove

Save a View

Once you execute a query, you can save the query results as a view.

To save a view:

1. Click the hamburger menu icon at the upper-left corner of the Alerts page.

2. From the slide-out, click the + icon. The SAVE VIEW popup is displayed.

   

3. Enter a name for the view and click ADD.

4. The view is saved and displayed in the slide-out.

   

• Use the up/down arrow icons to hide/show the views in the slide-out.
• The Save and Restore icons appear after you create a view.

Set Favorite

To mark a view as favorite:

1. Search for the view using the search icon.

2. Hover over the view name on the slide-out.

   

3. Click the star icon. The view is added as favorite and appears under the FAVORITE category. The blue colored star icon indicates that the view is added as favorite. If you want to unfavorite the view, click the blue colored star against the view. The view is removed from the Favorite category.

You can perform the following other actions on the saved view:

Restore

The Restore option reverts to the previous query.

Once you have made changes to a specific query, which is already saved as a view:

1. Hover over the view name on the slide-out.
2. Click the actions menu. The VIEW OPTIONS popup is displayed.
3. Click the Restore option. The previous query automatically appears in the Search box.
   Note: You must not save the changes you made to the query for the view. Otherwise, the query will not be reverted.

Rename

The Rename option allows you to rename the name of the view.

To rename a view:

1. Hover over the view name on the slide-out.
2. Click the actions menu. The VIEW OPTIONS popup is displayed.
3. Click the Rename option. The RENAME VIEW popup is displayed.
4. Enter a new name for the view in the Name box and click SAVE. The view is renamed.

Copy

The Copy option allows you to create a copy of a view.

To create a copy of a view:

1. Hover over the view name on the slide-out.
2. Click the actions menu. The VIEW OPTIONS popup is displayed.
3. Click the Copy option. The COPY VIEW popup is displayed.
4. Enter a name for the view in the Name box and click SAVE. The view is copied and is displayed in the slide-out.

Set Default View

The Set Default View option allows you to set a view as a default view for the current user.

To set a view as a default:

1. Hover over the view name on the slide-out.

2. Click the actions menu. The VIEW OPTIONS popup is displayed.

3. Click the Set Default View option. The Set Default View dialog box is displayed.

   

4. Turn on the My Default View option.

5. Click the SET DEFAULT button.

6. Refresh the browser. You can see that the view is set as default for the current user.

7. To set the default view for other users, share the view and make it default for the user you want to set as default.

Share

The Share option allows you to share an alert view to a particular partner or client role. Select the Partner Roles and Client Roles from the Share View - View Name window and click Share.

To share a view:

1. Hover over the view name on the slide-out.

2. Click the actions menu. The VIEW OPTIONS popup is displayed.

3. Click the Share option. The Share View dialog box is displayed.

   

4. Select a role from the drop-down list.

5. Click SHARE. The view is shared.

Notes:

• The view will be available to the users with the assigned roles.
• If you are logged in as a Partner, you can share the alert view to both partners and clients.
• If you are logged in as a Client, you can share the alert view only to the clients.
• The views can be shared to more than one role.
• A user who has selected a default view can also assign it as a default to other users. To do so, the user has to share the view using the View - Share option.

Remove

The Remove option allows you to remove a view.

To remove a view:

1. Hover over the view name on the slide-out.
2. Click the actions menu. The VIEW OPTIONS popup is displayed.
3. Click the Remove option. A confirmation dialog box is displayed.
4. Click REMOVE. The view is removed.

Alerts Details page

The new Alerts details page provides a comprehensive view of the alerts that are generated.

The Alerts Details page allows you to:

• View information about an alert.
• Perform various actions like create an incident, attach an incident, view alert history, view resource alerts.

To access the Alerts Details page:

1. Click Command Center > Alerts. The Alerts listing page is displayed.

   

2. Click the Alert ID for which you want to view details. The alerts slide-out is displayed which has the summary of the alert.

3. Click View details.

   

Following is the information that is displayed on the Alerts details page and the actions you can perform:

Examples

The following are example illustrations for each alerts:

Log Alert Visualization with Inputs

The subsequent section provides a visual representation of log alerts along with their corresponding inputs. The log time range is prominently displayed, and by clicking it, you are seamlessly navigated to the logs page.

In contrast to the previous version where only the metric graph was visible, the updated visualization now includes a logarithmic graph. Moreover, the definition name is now presented as LOG.

Filter: alertType = LOG

Change Detection Alert Visualization with Inputs

For lower, upper, and average values, you’ll see the alert definition name if created through an alert definition, and the template name if created from a template.

By clicking on the Definitions page within the details section, you will be redirected to the Alerts page.

Filter: alertType = Change_Detection

Monitoring Alerts Visualization with Inputs

Upon the generation of an alert from an alert definition, the alert definition name will be visibly presented. In cases where the alert is created from a template, the monitoring template name will be displayed.

Note: Alerts generated from the Alert Definition are produced using PromQL.

Filter: alertType = Monitoring

Integration Alerts Visualization with Inputs

When object type is equal to integrations, only integration data is present; no resource data is included. The name of the integration data is specified.

Filter: Object Type = Integration

View Historical Alert Comments

You can use the Include Alert Comment History checkbox on the alert details page to view previous comments logged in the Activity Log (Alert Log) for alerts that have reappeared on the same Host, Metric, and Component.

Use Case
When a new alert is triggered for the same Host, Metric, and Component combination as a previous one, users often need to quickly understand the alert’s history. By enabling the Include Alert Comment History option, you can access comments from prior alerts, giving you insight into past troubleshooting actions.

To enable the checkbox:

1. From the Alerts page, select any alert to view its details.

2. On the alert details page, scroll down to the Alert Log section.

3. Select the Include Alert Comment History checkbox.
   The system displays up to the last 200 comments from historical alerts.

   

Related Topics

Infrastructure Search