Skip to content

Update rules-engine-matching-conditions.rst #1731

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Update rules-engine-matching-conditions.rst #1731

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a56ea6e
Update rules-engine-matching-conditions.rst
cmillane Apr 19, 2025
bc640cc
Update rules-engine-matching-conditions.rst
johannahp-splunk Apr 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 16 additions & 7 deletions sp-oncall/alerts/rules-engine/rules-engine-matching-conditions.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,20 +13,13 @@ Matching conditions for the Rule Engine

Matching conditions determine when a rule is applied. You can choose any field that exists within the payload of an alert and match on a specific value for that field using a direct match, wildcard matching, or by using a regular expression.

By default, the Rules Engine only uses wildcard matching. If you want to turn on regular expressions, contact Splunk On-Call support.

Requirements
==================

This integration is compatible with the following versions of Splunk On-Call:

- Enterprise

All users have the ability to reach out to Splunk On-Call support at any time with questions.

Live Chat: If you are logged into your Splunk On-Call instance, you will have the ability to Live Chat with the Splunk On-Call Support team.


Field names
==================

Expand Down Expand Up @@ -116,6 +109,13 @@ Regular expression examples
- ``cat`` |br| ``car`` |br| ``catalyst`` |br| ``carbon`` |br| ``a la carte``
- ``chart`` |br| ``clark``

Routing Key matching
===================================

In addition to Wildcard and Regular expression matching, you can explicitly define routing key matching via the :guilabel:`Associated routing key` selector. This provides AND logic to the matching parameters specified in your Wildcard or RegEx matching section.

.. note:: Routing Key matching via the :guilabel:`Associated routing key` selector is unable to match on other routing keys via the top-bar Wildcard or RegEx matching criteria or manipulate routing keys via the :guilabel:`Transform these alert fields` section. It only provides an AND matching condition, specifically for a routing key, for use alongside your other matching and transformation parameters.

Boolean logic
===================================

Expand All @@ -139,3 +139,12 @@ The matching condition for the second rule, which you must position below the fi
.. image:: /_images/spoc/matching4.png
:width: 100%
:alt: VictorOps Alert Rules Engine, when new_matching_field matches *stage-db-26* set message_type to INFO

Rule processing order
===================================
Alert Rules uses three criteria to determine the processing order:
* Top-to-bottom order of the alert rules
* The optional :guilabel:`Stop after this rule has been applied` setting on each rule
* Rules with a matching routing key based on the :guilabel:`Associated routing key`

For each ingested alert, all rules without a matching :guilabel:`Associated routing key` will process based on the top-to-bottom order. If a rule matches with the :guilabel:`Stop after this rule has been applied` setting, it will stop the application of alert rules for that alert. Lastly, rules with a specific matching routing key based on the :guilabel:`Associated routing key` are applied. These rules are applied last so they can match on the final routing key of an alert, in case this value is changed by a different alert rule.
Loading