Skip to main content

Time Filter Action

Available for event, alert, and incident workflows

This action filters events, alerts, or incidents that pass through a previous action. Based on whether the events, alerts, or incidents match the given filter, you can then decide whether to proceed to the next action, skip to the next workflow, or stop processing.

This Filter section of this action takes the following inputs:

  • IF the event/alert/incident field

    Select an event, alert, or incident field. Then select a time range, the days of the week that the filter should include, and a time zone.

    Your local time zone is set as the default. If you select another time zone, then the selected time zone will be displayed for any user in any time zone going forward.

  • ELSE

    Select whether to skip to the next workflow or to drop the event, alert, or incident, if the filter does not match.

Event example

Suppose that as part of your noise reduction strategy you want to drop warning and minor severity events that arrive from test systems between 8:00 PM and 8:00 AM UTC.

To do this, create an event workflow with two actions: a Trigger and a Time Filter action.

  1. Configure the workflow trigger with a filter that includes severity and an environment tag.

    severity in (Warning, Minor) and tags.environment = test

  2. Add a Time Filter action.

  3. Set IF the event field to time.

  4. Configure the time range to start at 8:00 AM and end at 8:00 PM.

  5. Select all the days of the week.

  6. Set the time zone to "(GMT+00:00) Etc/UTC."

  7. Set ELSE to Drop the event. Events that meet the trigger action criteria but fail to meet the Time Filter criteria (low-severity test events that arrive overnight) are dropped.

Alert example

Suppose that you want to assign all new alerts generated from 8:00AM to 11:00AM UTC on Mondays and Tuesdays to a certain team. You can accomplish this by creating an alert workflow with three actions: a Trigger, a Time Filter action, and an Assign action.

  1. Select New alerts only in the workflow trigger to initiate the workflow only when alerts are created.

  2. Add a Time Filter action and set IF the alert field to created_at.

  3. Configure the time range to start at 8:00 AM and end at 11:00 AM.

  4. Select Monday and Tuesday for the days of the week.

  5. Set the time zone to "(GMT+00:00) Etc/UTC."

  6. Set ELSE to Skip to the next workflow so alerts that do not meet the Time Filter criteria are not processed by the Assign action in the next step.

  7. Add the Assign action and configure it to assign the alert to the preferred team.

Incident example

Suppose that you want to set up two dashboards so you can retrospectively compare patterns and performance for weekday and weekend incidents. You can accomplish this by creating an incident workflow with three actions: a Trigger, a Time Filter action, and a Set Tag action.

  1. Select New or changed incidents in the workflow trigger to initiate the workflow when incidents are created or updated.

  2. Configure a Set Tags action to generate tags.weekend with a value of "False."

  3. Configure a Time Filter action and set IF the incident field to created_at. For the time range, select Saturday and Sunday.

  4. Set ELSE to Skip to the next workflow.

  5. Configure a second Set Tags action to set tags.weekend to "True."

  6. Set up weekday and weekend incident dashboards using tags.weekend as a filter.

In this section: