Searching and filtering alerts

Search for alerts by name, or filter the list based on selected criteria. You can also save a filter configuration for future use.

Click the navigation icon at the upper-left corner of the screen to go to the main navigation menu.
In the main navigation menu, click Operate > Alerts.

Search alerts

To search for an alert in the table:

Click anywhere in the Search field.
Start typing a description of the alert in the search field. For example, type "error" and the system will show in the table all alerts that contain the text "error" in the summary.

Note: A search term entered in the Search text field is not part of a saved filter. Only the configuration applied in the Filter conditions side panel is part of the saved filter.

Predefined alert filters

All Alerts are displayed in the alert list by default. Click the Down chevron icon to select from the following predefined filters:

Customized alert filters

Select an existing filter from the drop-down menu or use the default All Alerts.
Click the Filter icon to open the filter side panel.

Figure. Alert filters
Apply filters to the alert list (or apply additional criteria to an existing filter). Select from the following filters for alerts:
- Severity:
  - Critical
  - Major
  - Minor
  - Warning
  - Informational
  - Indeterminate
- Suppressed:
  - Yes
  - No
- State:
  - Open
  - Clear
  - Closed
- Insights:
  - Part of an incident
  - Runbooks available
  - Enrichment
- Impacted applications:
  
  Find impacted applications to filter by.
- Grouping insights:
  - Temporal
  - Scope-based
  - Topological
- Other properties
  
  You can create more personalized filters by using alert properties. Expand the Other properties section and complete the fields as follows:
  - AND and OR: when adding conditions, you can join multiple condition types by using the AND and OR operators. The AND operator means that alerts are matched only if all of the individual conditions are true. The OR operator means that alerts are matched if any of the individual conditions are true. The default behavior for alert filter conditions is AND.
  - Property: select from alert attributes that are predefined for Cloud Pak for AIOps and common to most alerts.
    - If you want to minimize the scope to a singular key within the alert's details, enter a string value that matches a key from an alert's details. For example, if you enter "field1" in the Property field, it is understood as "details.field1". Then, enter the string value in the Value field. Note: The permitted characters for the "details" field are A to Z, a to z, 0-9, and "_" (underscore).
    - You can also access additional properties of alert.sender, alert.resouce, and alert.type by typing your custom property in the Property field. For example, to filter alerts where the alert.sender.customProperty = "custom", type sender.customProperty and select "Property: sender.customProperty". The only permitted special character for custom properties is "_" (underscore).
      
      For more information, see Examples of policy conditions mapped to alert JSON.
      
      Figure. Custom property filter
  - Operator: select a comparison operator from this list. The range of comparisons available is determined by your selection in the Property field.
  - Value: the fields (or free-form string value) that appear here are dependent on the options selected in the Property and Operator lists.

To update an existing filter

After you have modified the existing filter criteria, click Save.
A Filter updated message is displayed to confirm that your changes have been saved.

Note: An asterisk (*) is displayed next to the filter name if there are unsaved changes to the selected filter. An asterisk is also displayed when another user has modified the current filter. Unsaved filters are only applied to the already fetched alerts. Click Reset filter in the filter side panel to get the latest changes to the filter and have them applied to the alert list.

To save as a new filter

After you have applied the filters, click the three vertical dots in the Filter conditions side panel to open the list of options.
Click Save as a new filter.

Figure. Filters side panel
Enter a Filter name and Description.

Note: Filter names must be unique across different categories of filters, whether a normal filter or a restriction filter set by an administrator. If a chosen filter name is already in use for any type of filter, an error message is displayed to say the filter name already exists.

Select who can use this filter from the following options:
- Only me
- Specified users, user groups, or both: to manage access, you can select users, user groups, or both. Any selections you make includes yourself. After you select the users or user groups who can use the filter, you must specify their level of access:
  - Can use: users can see the filter in the drop-down list and apply it to the list of alerts.
  - And edit: users can use, edit, and save the filter.
  - And manage: users can use, edit, and manage the filter name, description, and access control.
- Everyone: additionally specify if everyone can Use this filter or Edit this filter.

To clear changes that have been applied to a filter, click Reset filter in the filter side panel or Clear all from the list of options (three vertical dots). From the options list you can also Delete filter and Edit filter settings.

To save as a new filter

After you have applied the filters, click the three vertical dots in the Filter conditions side panel to open the list of options.
Click Save as a new filter.

Figure. Save as new filter dialog

Note:: Alternatively, if you are an administrator who has manage profiles priviledges had enabled, you can set Role Based Access Control (RBAC) functionality that allows you see and click the Save as a new restriction filter option, thus applying certain restriction filters to data types and resources, alerts in this case. The save a new restriction filter dialog window is slightly different to the Save a new filter dialog also.

Figure. alerts save as new restriction filter

Figure. Filters side panel
Enter a Filter name and Description.

Note: Filter names must be unique across different categories of filters, whether a normal filter or a restriction filter set by an administrator. If a chosen filter name is already in use for any type of filter, an error message is displayed to say the filter name already exists.

Select who can use this filter from the following options:
- Only me
- Specified users, user groups, or both: to manage access, you can select users, user groups, or both. Any selections you make includes yourself. After you select the users or user groups who can use the filter, you must specify their level of access:
  - Can use: users can see the filter in the drop-down list and apply it to the list of alerts.
  - And edit: users can use, edit, and save the filter.
  - And manage: users can use, edit, and manage the filter name, description, and access control.
Figure. alerts save as new filter
- Everyone: additionally specify if everyone can Use this filter or Edit this filter.