All Apps and Add-ons

Suppressing using priority field in Alert Manager

logginz85
Explorer

Hi.

We've recently started using Alert Manager on Splunk Cloud (8.1.2) and have managed to create dynamic alerts based upon a lookup of impact and urgency. 

These calculate the "priority" field in Alert Manager, and we're looking for a way to suppress the "informational" level alerts (low/low)

Under Settings> Suppression Rules, I figured I could set up a rule that went as such,

Rule type = Normal
Scope = Rule_name*
Field = $priority$
Condition = is
Value = informational

Yet this does not seem to suppress anything.

I have tried with Field = $result.priority$ but that doesnt work either.

Any help would be greatly appreciated

Labels (3)

jdanielabacode
Engager

I have the exact same issue.  I've read over the alert manager documentation as well and that also gives no further insight. Has anyone come across a solution?

0 Karma

logginz85
Explorer

logginz85_0-1602752472293.png

looking just to suppress/auto-resolve on the main Alert manager page (Incident Posture?)

I'm unsure how I'd go about modifying macros tbh.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It depends on where are you wanting to suppress the data. 

Are you willing to modify macros?  If so, add this to filter out informational alerts.

| where priority!=informational

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...