All Apps and Add-ons

Suppressing using priority field in Alert Manager

logginz85
Explorer

Hi.

We've recently started using Alert Manager on Splunk Cloud (8.1.2) and have managed to create dynamic alerts based upon a lookup of impact and urgency. 

These calculate the "priority" field in Alert Manager, and we're looking for a way to suppress the "informational" level alerts (low/low)

Under Settings> Suppression Rules, I figured I could set up a rule that went as such,

Rule type = Normal
Scope = Rule_name*
Field = $priority$
Condition = is
Value = informational

Yet this does not seem to suppress anything.

I have tried with Field = $result.priority$ but that doesnt work either.

Any help would be greatly appreciated

Labels (3)

jdanielabacode
Engager

I have the exact same issue.  I've read over the alert manager documentation as well and that also gives no further insight. Has anyone come across a solution?

0 Karma

logginz85
Explorer

logginz85_0-1602752472293.png

looking just to suppress/auto-resolve on the main Alert manager page (Incident Posture?)

I'm unsure how I'd go about modifying macros tbh.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It depends on where are you wanting to suppress the data. 

Are you willing to modify macros?  If so, add this to filter out informational alerts.

| where priority!=informational

 

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.