View incidents
The Incidents page displays the most recently created incidents. Select an incident in the table to view details about that incident and view its member alerts and metrics. See also Incidents API.
Incidents and incident details reference
The following table lists the incident attributes visible in the Incidents table and Incident Details pane.
Note
Moogsoft stores all timestamps in UTC format. The dates and times displayed in the UI are based on your browser's local time.
Attribute | Description |
|---|---|
Assignee | The person assigned to the incident. |
Classes | A list of the classifications ( |
Closed on | Timestamp when this incident was closed. |
Created At | Timestamp when the Correlation Engine created this incident. |
Description | Auto-generated description of the incident, based on the |
First Event Time | Timestamp of the earliest event in this incident. |
ID | Moogsoft auto-generates this ID when it creates the incident. |
Last Event Time | Timestamp of the most recent event in this incident. |
Last State Change | The last time a user updated the incident status or severity. |
Resolved On | Time when the incident was resolved. |
Services | A list of all services that generated the events and metrics included in this incident. This list is derived from the |
Severity | The incident severity equals the highest severity of any alert in that incident. |
Status | Status of the incident. |
Total Alerts | The total number of alerts in the incident. |
Searching and filtering incidents
You can do the following types of search:
Free-text search in the Global Search window in the top left.
"Smart look-ahead" filtering in the Incidents, Alerts, and Metrics tables. Place your cursor in the search field above the table. A pull-down menu shows the data fields or operators that are valid for that position in the filter string.
After you validate a filter you can save, edit, reuse, and delete it as needed. You can also copy and paste a filter string into a relevant API request. You can define compound filters such as:
source in ("MCsource01", ["MCsource02") and severity in (Critical, Major, Minor)
Note the following:
It is good practice to use the smart-lookahead features to create your incident, alert, and metric filters.
Incident, alert, and metric filters support different sets of fields. This means that you cannot necessarily use filters across data types. The filter
service in (svc00, svc01)works for incidents and alerts but not for metrics, because incidents and alerts have aservicefield but metrics do not.