We are attempting to use Alert Manager as a way to maintain an audit trail. We open cases and note them before closing but there are some that we'd want to auto suppress. I'm sure I'm missing something simple here hence the post. The page in Alert Manager says:
Usage
- Use "$result.fieldname$" (without quotes) to refer to a field from results. Can either be used in "field" or "value"
- Use "$fieldname$" (without quotes) to refer to a metadata field, such as "$title$". Can either be used in "field" or "value"
- Use "_time" (without quotes) in "field" to compare the incident timestamp against a value (e.g. for maintenance windows)
If I try to just put $title$ in the field space and specify a title, nothing gets suppressed. Do I need to use different language / arguments here? Thank you in advance.
