Alarm Filters

Alarms can be filtered either in the Alarm Cards view or the Alarm Grid to help narrow down the displayed results and more easily find the alarm you need. Filters are based on AIE Summary Fields and Groupby fields.

You can filter alarms by the following fields:

• Time Frame

• Alarm Status

• Entity

• Alarm Rule

• Risk

• Notification List

• Alarm ID

• Classification

• Common Event

• Log Source

• Entity (Origin & Impacted)

• IP (Origin & Impacted)

• Hostname (Origin & Impacted)

• User (Origin & Impacted)

• Location (Origin & Impacted)

• VMID

From the lists for various alarm filters, you can also view the number of matching alarms for each filter value.

The alarms listed in italics above can also dynamically render dropdown values based on event data fetched from the Web Indexer, ensuring that filters are populated with relevant, real-time options for accurate and context-aware alarm filtering. Additionally, event-level details for some alarms are available in the Alarm Inspector Panel.

Any alarm filters that you apply remain in place until you remove them, even if you log in and out of your Web Console account. Filters also remain in place when switching between the Alarm card and Alarm grid views. Active alarm filters are indicated by filter text that is highlighted blue.

In the Alarm card view, the filters are at the top of the page.

In the Alarm grid view, the filters are at the top of the grid.

For information on removing alarm filters, see Remove Alarm Filters.

If an alarm contains two events, applying filters for both events result in the alarm being displayed on the Alarm page. Similarly, if an alarm is associated with multiple events, applying a filter that matches any one of those events still renders the alarm in the filter results, ensuring that alarms are not excluded simply because only one event meets filter criteria.