Viewing and Investigating Alerts for Connected Devices

When an alert triggers, the next step is to understand its impact and begin your investigation. This guide explains how to use the Alerts page to view the details of an active alert, temporarily suppress its notifications, and use the deep link to jump directly into the Analytics module for root cause analysis.

While this guide covers the basics, the user interface and functionality of these views are shared across the ThousandEyes platform. For a comprehensive guide on searching, filtering, and navigating the alert views, see our main documentation on Looking Up Alerts from the Alerts Screen.

Active Alerts vs. Alerts History

To view and manage alerts for your Connected Devices, navigate to the Alerts menu in the side navigation. If you have any ongoing issues, a red circle on the menu item indicates the number of active alerts.

The Alerts page is organized into two tabs: Active Alerts and Alerts History.

Active Alerts

This tab is your primary dashboard for viewing all ongoing issues that require attention. The list shows key information for each alert, such as its start time, impacted tests, and severity. Clicking on any alert row opens a side panel with more detailed information and the option to suppress the alert.

Alerts History

Use the Alerts History tab to review past incidents. This area provides a searchable archive of all previously active alerts that have since been resolved or "cleared."

Understanding How Alerts Clear

An alert "clears" automatically once the performance issue is resolved. This occurs on the first test round where the results no longer meet the conditions defined in your alert rule.

It is important to note that you cannot manually clear an alert. The system manages the alert's lifecycle based on live test data to ensure the status always reflects the actual, measured state of your network.

For a more detailed explanation of the alert clearing process, see our main documentation on Alert Clearing.

Suppressing an Alert

To temporarily stop notifications for an alert that is already active, you can use the Suppress function. This is useful for reducing alert noise during a planned maintenance window or while your team is actively investigating an issue.

From the alert details side panel, click the Suppress button in the upper right-hand corner and choose a duration. This action silences all notifications for the selected period but does not resolve or clear the alert; it will remain visible in the Active Alerts list until the triggering condition is no longer met.

For more advanced options, such as creating scheduled suppression windows in advance of a maintenance event, see our main documentation on Alert Suppression Windows.

Investigating with the Analytics Deep Link

The primary workflow for investigating a Connected Devices alert is to use the deep link that takes you directly from the alert to the relevant data in the Analytics module.

From the alert details side panel, click the view more on Connected Devices link, located at the bottom.

This action opens the Analytics module in a new tab with a pre-filtered view designed for immediate root cause analysis. The view is automatically configured with the following filters:

Time Range: Anchored to the time the alert was triggered.
Metrics: Filtered to the specific metric(s) that breached the threshold (for example, Latency).
Agents: If the alert scope includes fewer than 500 agents, the view is filtered to show data only from those specific, affected devices.

This pre-filtered context allows you to begin your forensic investigation immediately, without needing to manually search for and filter the relevant data.

To learn more about how to interact with the charts and create custom reports in the Analytics module, see Using Dashboards and Creating Reports.

PreviousManaging Alert Notifications for Connected Devices NextAlerts Reference for Connected Devices

Last updated 2 months ago