We have noticed that the total amount of Prediction alarms in DX Dashboard is different than the count provided via DX OI Alarms Analytics UI, we are using the below query definition:
Quey: All_Alarms
Primary Index: ao_itoa_alarms_all_*
Query: alarmType:prediction AND status:*NOT "CLOSED"
Metric: Count
Group by: Terms status
Relative Time:365d
What is the correct query to use to create a DX Dashoboard that includes all Prediction alarms?
DX Operational Intelligence 20.x
For Capacity and Predictive Alarms you need to add an extra time filter "predictive_timestamp" to see alarms in the future
Example 1: Query Prediction "capacity" alarms
Quey: All_Alarms
Primary Index: ao_itoa_alarms_all_*
Query: alarmType:prediction AND status:*NOT "CLOSED" AND prediction_timestamp:[now TO now+3M] AND predictionCategory:capacity
Metric: Count
Group by: Terms status
Relative Time:365d
Example 2: Query Prediction "performance" alarms
Quey: All_Alarms
Primary Index: ao_itoa_alarms_all_*
Query: alarmType:prediction AND status:*NOT "CLOSED" AND prediction_timestamp:[now TO now+3M] AND predictionCategory:performance
Metric: Count
Group by: Terms status
Relative Time:365d
Example 3: Query all Prediction alarms
Quey: All_Alarms
Primary Index: ao_itoa_alarms_all_*
Query: alarmType:prediction AND status:*NOT "CLOSED" AND prediction_timestamp:[now TO now+3M]
Metric: Count
Group by: Terms status
Relative Time:365d