Skip to main content
Question

Create an Event Rule for a particular day/time/alert.

  • Oct 15, 2026 8:36 PM UTC
  • 1 reply
  • 13 views

I used an event rule (under the Service Orchestration) a couple years ago to suppress a particular alert for a small window which worked.

Working rule: (now in Mon,Tue,Wed,Thu,Fri,Sat,Sun 16:11:00 to 16:26:00 America/Los_Angeles) and (event.summary matches part exactly '**ST(MGAS) Grid Application status: CloudSuite ** Base-******-EventHub')

Recently I’ve added a similar rule but for a particular day and time but the alert triggered any way.

Failed rule: (now > 2026-10-09 21:00:00 Asia/Singapore and now < 2026-10-10 01:00:00 Asia/Singapore) and (event.summary matches part 'Deployment Replicas Unavailable')

Has something changed that doesn’t allow this type of rule or am I doing something wrong?

Thank you.

1 reply

danieljcafonso
Forum|alt.badge.img
  • Community Manager 💚
  • Oct 29, 2026 11:26 AM UTC

 

Hey there! 👋

Thanks for including both rules, that makes this much easier to look at!

Good news first: nothing has changed that would block this kind of rule. Using now > and now < with a specific date and time is fully supported, and your syntax looks right.

So the rule itself is probably fine, and something else stopped it from matching. Here are the most common reasons, worth checking in this order:

  1. Rule order. Within a set of rules, an event only matches the first rule it fits. If another rule higher up also matches this alert, your new rule never gets a chance to run. Try moving it to the top.
  2. Email alerts. If this alert comes in through an email integration on the service, the Service Orchestration rules are skipped entirely and only the email filters and rules apply.
  3. Time zone. The window you set is in Singapore time (21:00–01:00). Check what time the alert arrived in Singapore time. If it came in just outside the window, the rule won’t match.
  4. Alert summary text. Open the alert and compare its summary with Deployment Replicas Unavailable. Matching ignores upper and lower case, but the words, spaces, and punctuation need to appear exactly as written somewhere in the summary.
  5. The rule’s action. Confirm the rule’s action is set to suppress the alert.

Helpful docs:

If none of those turn out to be the issue, reply with the alert’s exact summary and the time it triggered (with anything sensitive removed), and we’ll take a closer look!