Customize assertion name and description
You can customize assertion names and descriptions with dynamic field values using string interpolation.
About this task
When saving an assertion, you can use field placeholders in the name and description fields. These placeholders are replaced with actual values from your query results when alerts are generated. This lets you create more descriptive and context-aware assertion names and alert descriptions.
Procedure
-
In the top navigation bar, select .
The Assertions page opens.
- In the query field, enter a query.
- Select Enter.
-
Select Save.
A dialog shows.
-
In the Name field, enter a name for the assertion. To
insert a field value from your query, select the plus icon button next to the
field.
A placeholder
{{FIELD_NAME}}is inserted into the field withFIELD_NAMEhighlighted. Replace it with the actual field name from your query.Tip:Field names must match the fields returned by your query. For example, if your query returnshost,name, oripfields, you can use{{host}},{{name}}, or{{ip}}. -
In the Description field, enter a description. You can
also use field placeholders here by selecting the plus icon button.
Example:
The sensor {{host}} with model {{model}} has been offline for more than 15 minutes - Complete the remaining fields in the dialog and select Save.
Results
When the assertion generates an alert, the placeholders in the name and description are replaced with the actual values from the query results.
Example
If you save an assertion with the following configuration:
- Name:
Sensor offline: {{host}} - Description:
The sensor {{host}} with model {{model}} has not synchronized in the last 15 minutes - Query:
sensors | where minutes_ago(last_sync) > 15 | assert_empty
When a sensor with host = nozomi-guardian and
model = V-SERIES fails the assertion, the
generated alert will display:
- Name:
Sensor offline: nozomi-guardian - Description:
The sensor nozomi-guardian with model V-SERIES has not synchronized in the last 15 minutes