Suppress alerts from short-lived anomalies
Apply sustained alert feedback to generate alerts only when anomalies persist for a set duration in Health Log Analytics.
Before you begin
Role required: evt_mgmt_operator or evt_mgmt_admin
About this task
Short-lived anomaly spikes that resolve quickly often don't require alerts. If a metric jumps briefly and resolves on its own, the spike is noise and not actionable. The sustained alert feature helps reduce this noise. When you apply sustained alert feedback, the anomaly must persist continuously for 15 minutes before Health Log Analytics generates an alert.
By default, the system calculates this duration automatically based on the metric's signal amplitude, historical anomaly patterns, and previous sustained alert applications (adaptive mode). You can override it and set a fixed duration yourself, instead (manual mode).
Procedure
-
Open a Log Analytics alert.
-
In the Service Operations Workspace, select the list icon ([Omitted image "icon-lists-sow.png"] Alt text: List icon.).
-
Select the appropriate list in the Alerts sub-list and open the alert you want to configure for sustained alert feedback.
In the All Alerts list, alerts that were generated by Health Log Analytics have the value Log Analytics in the Source column.
-
Select the alert number.
-
-
Select Apply ML feedback and then choose Sustain Alert.
A message confirms that the anomaly must persist for 15 minutes before an alert is generated.
Health Log Analytics applies adaptive mode by default and calculates a recommended duration automatically. A confirmation message states the calculated duration and that it's based on signal amplitude and patterns, for example, "Sustained Alert applied: 12 min (Smart)".
-
To set a fixed duration instead of using the calculated adaptive duration, switch to manual mode.
-
Select the [OXY-PLACEHOLDER] advanced option next to Sustain Alert.
-
Select a preset duration (5, 10, 15, 20, or 30 minutes), or specify a custom duration between 1 and 120 minutes.
-
Confirm the duration.
Health Log Analytics applies the duration you set instead of the calculated adaptive duration.
-
-
Confirm sustained alert feedback application.Review the applied sustained alert feedback.
Sustained alert feedback is applied to the metric. Anomalies that persist for less than the continuous duration threshold are suppressed. The sustained alert configuration applies across user sessions and system restarts.
The value Sustained is displayed underneath the Applied feedback label in the header strip at the top of the alert record.A value showing the applied duration and mode is displayed underneath the Applied feedback label in the header strip at the top of the alert record. For example, Sustained: 12 min (Smart) for adaptive mode or Sustained: 20 min (Custom) for manual mode.
-
Remove the sustained duration threshold for anomalies like the one that triggered this alert.
-
While viewing the alert, select Restore ML feedback.
-
Confirm the action in the dialog box.
The system removes the sustained alert configuration for the metric associated with this alert.
-
---
title: Suppress alerts from short-lived anomalies
description: Apply sustained alert feedback to generate alerts only when anomalies persist for a set duration in Health Log Analytics.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/it-operations-management/health-log-analytics/hla-sustained-alert-apply.html
release: brazil
product: Health Log Analytics
classification: health-log-analytics
topic_type: task
last_updated: "2026-09-14"
reading_time_minutes: 2
keywords: [apply feedback, sustained alert, alert card, Health Log Analytics, adaptive duration]
breadcrumb: [Assign higher or lower significance to an alert, Managing alert generation, prioritization, anomaly detection, Health Log Analytics, ITOM AIOps, IT Operations Management]
---
# Suppress alerts from short-lived anomalies
Apply sustained alert feedback to generate alerts only when anomalies persist for a set duration in Health Log Analytics.
## Before you begin
Role required: evt\_mgmt\_operator or evt\_mgmt\_admin
## About this task
Short-lived anomaly spikes that resolve quickly often don't require alerts. If a metric jumps briefly and resolves on its own, the spike is noise and not actionable. The sustained alert feature helps reduce this noise. When you apply sustained alert feedback, the anomaly must persist continuously for 15 minutes before Health Log Analytics generates an alert.
By default, the system calculates this duration automatically based on the metric's signal amplitude, historical anomaly patterns, and previous sustained alert applications \(adaptive mode\). You can override it and set a fixed duration yourself, instead \(manual mode\).
## Procedure
1. Open a Log Analytics alert.
1. In the Service Operations Workspace, select the list icon \(\[Omitted image "icon-lists-sow.png"\] Alt text: List icon.\).
2. Select the appropriate list in the Alerts sub-list and open the alert you want to configure for sustained alert feedback.
In the **All Alerts** list, alerts that were generated by Health Log Analytics have the value **Log Analytics** in the **Source** column.
3. Select the alert number.
2. Select **Apply ML feedback** and then choose **Sustain Alert**.
A message confirms that the anomaly must persist for 15 minutes before an alert is generated.
Health Log Analytics applies adaptive mode by default and calculates a recommended duration automatically. A confirmation message states the calculated duration and that it's based on signal amplitude and patterns, for example, "Sustained Alert applied: 12 min \(Smart\)".
3. To set a fixed duration instead of using the calculated adaptive duration, switch to manual mode.
1. Select the **\[OXY-PLACEHOLDER\]** advanced option next to **Sustain Alert**.
2. Select a preset duration \(5, 10, 15, 20, or 30 minutes\), or specify a custom duration between 1 and 120 minutes.
3. Confirm the duration.
Health Log Analytics applies the duration you set instead of the calculated adaptive duration.
4. Confirm sustained alert feedback application.Review the applied sustained alert feedback.
Sustained alert feedback is applied to the metric. Anomalies that persist for less than the continuous duration threshold are suppressed. The sustained alert configuration applies across user sessions and system restarts.
The value **Sustained** is displayed underneath the **Applied feedback** label in the header strip at the top of the alert record.A value showing the applied duration and mode is displayed underneath the **Applied feedback** label in the header strip at the top of the alert record. For example, **Sustained: 12 min \(Smart\)** for adaptive mode or **Sustained: 20 min \(Custom\)** for manual mode.
5. Remove the sustained duration threshold for anomalies like the one that triggered this alert.
1. While viewing the alert, select **Restore ML feedback**.
2. Confirm the action in the dialog box.
The system removes the sustained alert configuration for the metric associated with this alert.
| title | Suppress alerts from short-lived anomalies |
| description | Apply sustained alert feedback to generate alerts only when anomalies persist for a set duration in Health Log Analytics. |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/it-operations-management/health-log-analytics/hla-sustained-alert-apply.html |
| release | brazil |
| product | Health Log Analytics |
| classification | health-log-analytics |
| topic_type | task |
| last_updated | 2026-09-14 |
| reading_time_minutes | 2 |
| keywords | apply feedbacksustained alertalert cardHealth Log Analyticsadaptive duration |
| breadcrumb | Assign higher or lower significance to an alertManaging alert generationprioritizationanomaly detectionHealth Log AnalyticsITOM AIOpsIT Operations Management |