The open incident filter supports joining terms in () as well as the AND, OR,
and ! operators. The following query terms are supported and are always in the format of something:something:
| Term Spec | Description |
|---|---|
ack:(true|false) |
If ack:true incidents that have been acknowledge are returned, when ack:false incidents that have not been acknowledged are returned. |
hasTag:(tagKey|tagKey=|=tagValue|tagKey=tagValue) |
Determine if the tag key, value, or key=value pair. If there is no equals sign, it is treated as a tag
key. Tag Values maybe have globs such has hasTag:host=ny-* |
hidden:(true|false) |
If hidden:false incidents that are hidden will not be show. An incident is hidden if it
is in a silenced or unevaluated state. |
name:(something*) |
Returns incidents where the alert name (not including the tagset) matches the value. Globs can be used in the value. |
user:(username*) |
Returns incidents where a user has taken any action on that incident. Globs can be used in the value |
notify:(notificationName*) |
Returns incidents where a the notificationName is somewhere in either the crit or warn notification chains. Globs can be used in the value |
silenced:(true|false) |
If silenced:false incidents that have not been silenced are returned, when silenced:true incidents that have not been silenced are returned. |
start:[<|>](1d) |
Returns incidents that started before < or incidents that started after > the
relative time to now based on the duration. Duration can be in units of s (seconds), m (minutes),
h (hours), d (days), w (weeks), n (months), y (years). If less than or greater than are not part
of the value, it defaults to greater than (after). Now is clock time and is not related to the time
range specified in Grafana. |
unevaluated:(true|false) |
If unevaluated:false incidents that are not in an unevaluated state are returned, when
ack:true incidents that are unevaluated are returned. |
status:(normal|warning|critical|unknown) |
Returns incidents that are currently in the requested state |
worstStatus:(normal|warning|critical|unknown) |
Returns incidents that have a worst status equal to the requested state |
lastAbnormalStatus:(warning|critical|unknown) |
Returns incidents that have a last abnormal status equal to the requested state |
subject:(something*) |
Returns incidents where the subject string matches the value. Globs can be used in the value |