How to delete older alarms in on premise OI?

Products

• DX Operational Intelligence

Issue/Introduction

Looking at OI we have 1.5 million alarms for a tenant. If we change the start date in OI to one month ago, we have almost 17 million alarms.  We need to delete older alarms. How can we delete the older alarms in OI? We are using on premise OI.

Environment

Release : 20.2

Component : CA DOI ALARM ANALYTICS

Resolution

Please review the following TechDoc, and try to test with one or two alarms, and see if this is working for you.

If this works for you then we can build a query to delete more alarms.

TechDoc: https://knowledge.broadcom.com/external/article/204085

It is possible to delete alarms by other fields.

Here is example of query which search for alarms for a host:

POST {Elastic-Endpoint}/ao_itoa_alarms_all_1*/_search

{
    "query": {
        "bool": {
            "must": [
               {
                   "match": {
                      "doc_type_id": "itoa_alarms_apm"
                   }
               },
               {
                           "match": {
                            "host": "CDSFestHFDJDHF034ger8"
                           }
        },
           {
                           "match": {
                              "status": "CLOSED"
                           }
        },                       
               {
                   "match": {
                      "@tenant_id": "<tenant ID>"
                   }
               }
            ]
        }
    }
}

 

This lists number of alarms specific for the host and in closed status.

Next, we can use the delete query to delete above alarms.

POST {Elastic-Endpoint}/ao_itoa_alarms_all_1*/_delete_by_query

We would suggest deleting small number of alarms to see if we get the expected results.

Also, we would suggest to do the tests in NON PROD first before moving to PROD.