Skip to main content
Version: Next

Event Summary Overview

The Event Summary page serves as the central hub for managing all events in Alert Manager Enterprise (AME).

info

In AME, an Event refers to a Splunk Alert managed by the app. A Splunk Alert can append to an existing AME event. See Alert Action Setup for details on event creation and updates.

tip

AME supports the Splunk Dark UI theme, configurable via Splunk User Preferences.

Single Value Indicators

Single Value Indicators at the top of the Event Summary display the number of events within the selected time range, split by priority, with a trend timeline below.

Toggle visibility with these buttons:

ButtonFunction
Show Single Values
Hide Single Values

Event Timeline

The Event Timeline, displayed below the Single Value Indicators, shows events over the selected time range, split by priority.

Toggle visibility with these buttons:

ButtonFunction
Show Event Timeline
Hide Event Timeline

About Priorities

Priorities are derived from an alert’s urgency and impact settings:

ImpactUrgencyPriority
lowlowinformational
lowmediumlow
lowhighmedium
mediumlowlow
mediummediummedium
mediumhighhigh
highlowmedium
highmediumhigh
highhighcritical

Event Table

The Event Table displays these default fields:

  • Title
  • Tenant
  • Status
  • Priority
  • Assignee

Fieldsets

If fieldsets are defined for the selected tenant, a fieldset dropdown appears:

info

Fieldsets are tenant-specific and visible only when events from a single tenant are displayed.

info

Alert result field values require AME 3.2 or higher to be displayed.

Quick Actions

Modify event attributes or perform actions using these buttons:

ButtonFunction
Change Assignee
Change Status
Actions

Actions Menu

The Actions menu offers these options:

  • Edit Tags
  • Adjust Notification Scheme
  • Adjust Urgency
  • Add Resolution
  • Delete Event
  • Display Action Fields
  • Run Drilldown Search (traces the originating Splunk search)

For more on managing events, see Working with Events.

Event Details

Click an event in the accordion table to view its details. Default top-level information includes:

  • Event ID
  • Notification Scheme
  • Count (number of grouped events with the same title)
  • Tags
  • First Seen (timestamp of the first grouped event)
  • Action Fields

Additional tabs provide:

  • Notable Fields
  • Data
  • History
  • Comments
  • SLAs

Event Details Tab Ordering

Adjust tab order in Tenant Configuration:

info

Requires an AME subscription.

Compact vs. Expanded View

The default Compact View shows limited details and requires opening an event for full visibility. The Expanded View displays selected attributes directly.

Switch views with these buttons:

ButtonFunction
Compact View
Expanded View

See Working with Events for details. Configure Expanded Views in Event Summary Configuration.

info

Displaying notables, tags, and customizing Notable/Event Fields require an AME subscription.

Filters

Filter displayed events using these buttons:

ButtonFunction
Open Filter
Reset Filter
Show Filter In-Page

Filters appear on the right as a slide-out or in-page panel:

Available filters include:

  • Time (default: Last 7 days)
  • Tenant
  • Title
  • Assignee
  • Priority
  • Tags
  • Status
  • Resolution
  • Search
  • Saved Search
  • SLA Filters

The Search field uses Splunk syntax, supporting:

  • event_key
  • event_title
  • fields.field_name
  • Free text

Applying Filters

Click Apply Filter or press Ctrl+Enter to apply.

Examples

vulnerability fields.dvc="host-1" OR fields.dvc="host-2"
event_title="Disk Usage*" OR event_title="High Memory*" fields.dvc="server-*"

Saved Filters

Save the current filter by clicking Save Current Filter, opening a modal:

Select saved filters from the dropdown next to Save Current Filter. Selected filters can be updated, renamed, or deleted.

info

Requires an AME subscription.

Refresh Interval

Set or disable the Event Summary refresh interval with this button:

ButtonFunction
Refresh Interval

Options:

  • No Refresh
  • 1 Minute
  • 5 Minutes
  • 15 Minutes
  • 30 Minutes
  • 1 Hour

The footer displays the selected time range, event count, and last reload time:

Toggle visibility with these buttons:

ButtonFunction
Hide Footer
Show Footer