How to ignore events during a specific daily time window in Event Management rules?

[Tetsuya3]

Hello,

In Event Management, I would like to configure an event rule that ignores events during a specific time window. For example, I want all events between 00:00–01:00 every day to be ignored.

I know that it is possible to specify dates in event rules, but is it also possible to configure rules based on time ranges or specific weekdays?

If this is not supported directly in event rules, what would be the recommended approach to handle this scenario? My requirement is that I do not want these events to generate new alerts at all.

Any suggestions or best practices would be greatly appreciated.

Thank you!

[Rafael Batistot · Accepted solution]

Hi @Tetsuya3 

Since your requirement is “do not generate alerts at all during 00:00–01:00 daily”, the best practice is to use a Suppression Rule (not an Event Rule).

1. Go to Event Management > Rules > Suppression Rules.
2. Create a new suppression rule that applies to the events you want to ignore (by source, node, CI, or other identifiers).
3. In the rule’s Advanced Condition (Script), insert:

var now = new GlideDateTime();
var hour = parseInt(now.getHourLocalTime());

// Suppress all events between 00:00 and 01:00
if (hour >= 0 && hour < 1) {
answer = true; // suppress
} else {
answer = false; // allow
}

1. Save and activate the suppression rule.

Any event that arrives between 00:00–01:00 daily will be suppressed.

Suppressed events do not create alerts (they’re effectively ignored).

This is the recommended approach, since Event Rules can’t handle time-based conditions directly.

[Swapna Abburi · Accepted solution]

Hi @Rafael Batistot 

Are you referring to Maintenance rules?

If yes, they execute on alerts to flag them as maintenance, however maintenance rules suprress alerts by configuration item. Within the configured schedule, you can suppress alerts triggered on specific Cis. 

[Bhuvan · Accepted solution]

@Tetsuya3 

As per my understanding, you cannot use recurring window in event rules for filtering.

You can try and enhance below logic,

https://www.servicenow.com/community/itom-forum/event-management-use-case/m-p/888389

To disable event collection for a specific source, you can automate via script using below logic of disabling connector and enabling the connector

https://www.servicenow.com/docs/bundle/zurich-it-operations-management/page/product/event-management...

Below is for consideration,

https://noderegister.service-now.com/kb?id=kb_article_view&sysparm_article=KB1743614

If this helped to answer your query, please mark it helpful & accept the solution.

Thanks,

Bhuvan

[Rafael Batistot · Accepted solution]

Hi @Tetsuya3 

Since your requirement is “do not generate alerts at all during 00:00–01:00 daily”, the best practice is to use a Suppression Rule (not an Event Rule).

1. Go to Event Management > Rules > Suppression Rules.
2. Create a new suppression rule that applies to the events you want to ignore (by source, node, CI, or other identifiers).
3. In the rule’s Advanced Condition (Script), insert:

var now = new GlideDateTime();
var hour = parseInt(now.getHourLocalTime());

// Suppress all events between 00:00 and 01:00
if (hour >= 0 && hour < 1) {
answer = true; // suppress
} else {
answer = false; // allow
}

1. Save and activate the suppression rule.

Any event that arrives between 00:00–01:00 daily will be suppressed.

Suppressed events do not create alerts (they’re effectively ignored).

This is the recommended approach, since Event Rules can’t handle time-based conditions directly.

[Swapna Abburi · Accepted solution]

Hi @Rafael Batistot 

Are you referring to Maintenance rules?

If yes, they execute on alerts to flag them as maintenance, however maintenance rules suprress alerts by configuration item. Within the configured schedule, you can suppress alerts triggered on specific Cis. 

[Rafael Batistot · Accepted solution]

@Swapna Abburi 

That was I thought first of all, but you right, is not applicable in this case 

[Bhuvan · Accepted solution]

@Tetsuya3 

As per my understanding, you cannot use recurring window in event rules for filtering.

You can try and enhance below logic,

https://www.servicenow.com/community/itom-forum/event-management-use-case/m-p/888389

To disable event collection for a specific source, you can automate via script using below logic of disabling connector and enabling the connector

https://www.servicenow.com/docs/bundle/zurich-it-operations-management/page/product/event-management...

Below is for consideration,

https://noderegister.service-now.com/kb?id=kb_article_view&sysparm_article=KB1743614

If this helped to answer your query, please mark it helpful & accept the solution.

Thanks,

Bhuvan