My simple thought was that alarms in ACTIVE should have a longer retention rule then CLEARED or ACKNOWLEDGED alarms. These alarms are already processed and need not longer attention. An ACTIVE alarm in contrast should never be deleted or at least much later, we lose maybe important information, and no user had a look at the alarm. Please think of a huge device fleet which sends a lot of data into the Platform, the data gets offloaded regularly and the data should be keept only for 7 days.
Is this somehow already working. If not, is there any customer/user which has similar requirement? Another field which could be interesting is “severity”.
unfortunately the only retention rule filter is the “type” for alarm. So for severity you can include it in the type and change the retention but for status this won’t work.
Right now the only thing you can do is to define the retention to the max for all status.
i got an information from R&D that indeed only alarms in status CLEARED get removed via retention rules! All other alarms in status ACTIVE or ACKNOWLEDGED will not be removed. Another important information is that lastUpdated time is used for retention rule. Which makes a lot of sense regards deduplication.