Skip to main content

Time Filter Action

Available for event, alert, and incident workflows

This action filters events or incidents according to the time or day of the week. Based on whether the events or incidents match the given filter, you can then decide whether to proceed to the next action or skip to the next workflow.

This action takes the following inputs:

  • Filter By

    The event or incident field to use for filtering. Set to "Created At" by default.

  • Time Range

    The time range to filter by. Select a start and end time. Optionally, select days of the week to include in your time range.

    Important

    To ensure that the filter applies across all time zones, enter the time range in Coordinated Universal Time (UTC).

  • Exit Option

    For events, if the event does not match the filter, either skip to the next workflow, or drop the event. For alerts and incidents, if the alert or incident does not match the filter, either skip to the next workflow, or stop processing the alert or incident.

Event example

Suppose that as part of your noise reduction strategy you want to drop warning and minor severity events that arrive from test systems between 8:00 PM and 8:00 AM UTC.

To do this, create an event workflow with two actions: a Trigger and a Time Filter action.

  1. Configure the workflow trigger with a filter that includes severity and an environment tag.

    severity in (Warning, Minor) and tags.environment = test

  2. Add a Time Filter action. Leave Filter By set to the default.

  3. Set the start time to 8:00 AM and the end time to 8:00 PM.

  4. Select Drop the event as the exit option. Events that meet the trigger action criteria but fail to meet the Time Filter criteria (low-severity test events that arrive overnight) are dropped.

Alert example

Suppose that you want to assign all new alerts generated from 8:00AM to 11:00AM UTC on Mondays and Tuesdays to a certain team. You can accomplish this by creating an alert workflow with three actions: a Trigger, a Time Filter action, and an Assign action.

  1. Select New alerts only in the workflow trigger to initiate the workflow only when alerts are created.

  2. Add a Time Filter action and, under Filter By, select Created At.

  3. Configure the time range to start at 8:00 AM and end at 11:00 AM.

  4. Under Day, select Monday and Tuesday.

  5. Select Skip to the next workflow for the exit option so alerts that do not meet the Time Filter criteria are not processed by the Assign action in the next step.

  6. Add the Assign action and configure it to assign the alert to the preferred team.

Incident example

Suppose that you want to set up two dashboards so you can retrospectively compare patterns and performance for weekday and weekend incidents. You can accomplish this by creating an incident workflow with three actions: a Trigger, a Time Filter action, and a Set Tag action.

  1. Select New or changed incidents in the workflow trigger to initiate the workflow when incidents are created or updated.

  2. Configure a Set Tags action to generate tags.weekend with a value of "False."

  3. Configure a Time Filter action to filter on "Created at." For range, select Saturday and Sunday.

  4. Select Skip to the next workflow for the Exit Option.

  5. Configure a second Set Tags action to set tags.weekend to "True."

  6. Set up weekday and weekend incident dashboards using tags.weekend as a filter.

In this section: