View incidents

Users with the following roles can perform these actions in this feature area:
Operator: View, assign, resolve, close and create incidents; add alerts.	Administrator:View, assign, resolve, close, and create incidents; add alerts.	Owner: View, assign, resolve, close, and create incidents; add alerts.

The Incidents page displays the most recently created incidents. Select an incident in the table to view details about that incident and view its member alerts and metrics. See also Incidents API.

Incidents and incident details reference

The following table lists the incident attributes visible in the Incidents table and Incident Details pane.

Note

Moogsoft stores all timestamps in UTC format. The dates and times displayed in the UI are based on your browser's local time.

Attribute	Description
Assignee	The person assigned to the incident.
Classes	A list of the classifications (`class` field) of all alerts in the incident. The class field is used to categorize the events and metric anomalies that make up an alert. For example, an alert with a "WebServerMonitor" class might include a "web-server-down" event and a "http-requests-failed-rate" anomaly.
Closed on	Timestamp when this incident was closed.
Created At	Timestamp when the Correlation Engine created this incident.
Description	Auto-generated description of the incident, based on the `description` field in the correlation definition that generated the incident.
First Event Time	Timestamp of the earliest event in this incident.
ID	Moogsoft auto-generates this ID when it creates the incident.
Last Event Time	Timestamp of the most recent event in this incident.
Last State Change	The last time a user updated the incident status or severity.
Resolved On	Time when the incident was resolved.
Services	A list of all services that generated the events and metrics included in this incident. This list is derived from the `service` field in the member alerts in this incident.
Severity	The incident severity equals the highest severity of any alert in that incident.
Status	Status of the incident.

Total Alerts	The total number of alerts in the incident.

Searching and filtering incidents

You can do the following types of search:

Free-text search in the Global Search window in the top left.
"Smart look-ahead" filtering in the Incidents, Alerts, and Metrics tables. Place your cursor in the search field above the table. A pull-down menu shows the data fields or users that are valid for that position in the filter string.
After you validate a filter you can save, edit, reuse, and delete it as needed. You can also copy and paste a filter string into a relevant API request. You can define compound filters such as:
source in ("MCsource01", ["MCsource02") and severity in (Critical, Major, Minor)

Note the following:

It is good practice to use the smart-lookahead features to create your incident, alert, and metric filters.
Incident, alert, and metric filters support different sets of fields. This means that you cannot necessarily use filters across data types. The filter service in (svc00, svc01) works for incidents and alerts but not for metrics, because incidents and alerts have a service field but metrics do not.

In this section:

View incidents

Incidents and incident details reference

Note

Searching and filtering incidents

Search results