Overview

The open incident filter supports joining terms in () as well as the AND, OR, and ! operators. The following query terms are supported and are always in the format of something:something:
Term Spec Description
ack:(true|false) If ack:true incidents that have been acknowledge are returned, when ack:false incidents that have not been acknowledged are returned.
hasTag:(tagKey|tagKey=|=tagValue|tagKey=tagValue) Determine if the tag key, value, or key=value pair. If there is no equals sign, it is treated as a tag key. Tag Values maybe have globs such has hasTag:host=ny-*
hidden:(true|false) If hidden:false incidents that are hidden will not be show. An incident is hidden if it is in a silenced or unevaluated state.
name:(something*) Returns incidents where the alert name (not including the tagset) matches the value. Globs can be used in the value.
user:(username*) Returns incidents where a user has taken any action on that incident. Globs can be used in the value
notify:(notificationName*) Returns incidents where a the notificationName is somewhere in either the crit or warn notification chains. Globs can be used in the value
silenced:(true|false) If silenced:false incidents that have not been silenced are returned, when silenced:true incidents that have not been silenced are returned.
start:[<|>](1d) Returns incidents that started before < or incidents that started after > the relative time to now based on the duration. Duration can be in units of s (seconds), m (minutes), h (hours), d (days), w (weeks), n (months), y (years). If less than or greater than are not part of the value, it defaults to greater than (after). Now is clock time and is not related to the time range specified in Grafana.
unevaluated:(true|false) If unevaluated:false incidents that are not in an unevaluated state are returned, when ack:true incidents that are unevaluated are returned.
status:(normal|warning|critical|unknown) Returns incidents that are currently in the requested state
worstStatus:(normal|warning|critical|unknown) Returns incidents that have a worst status equal to the requested state
lastAbnormalStatus:(warning|critical|unknown) Returns incidents that have a last abnormal status equal to the requested state
subject:(something*) Returns incidents where the subject string matches the value. Globs can be used in the value