---
sourceDocument: Zurich IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/it-operations-management

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Delete a custom Log Analytics alert rule

# Delete a custom Log Analytics alert rule in Health Log Analytics {#ariaid-title1}

* Release version: Zurich
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Delete a Log Analytics alert rule that you have defined if it is no longer necessary.

## Before you begin

For background information, see [Alert rules in Health Log Analytics](https://www.servicenow.com/docs/vAvhvaLLrb_ONXlBCDwRdg "Health Log Analytics (HLA) detects anomalies automatically by learning from your log data. However, some log types require a custom alert rule to generate alerts reliably.").


This feature is supported in the Health Log Analytics application, Version 20.0.11 - July 2021, and the Health Log Analytics Viewer application, Version 20.0.4 - July 2021, available from the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home).

Role required: evt_mgmt_operator or evt_mgmt_admin

## Procedure

1. Open the Log Viewer using one of the following methods:
   * Navigate to WorkspacesService Operations Workspace and select the Log Viewer icon (![Log Viewer icon.]()).
   * While viewing log entries for an alert on the Surrounding logs tab, select Log Viewer.
   {#hla-op-defined-alert-delete-sow__choices_ic4_dwh_gtb}
2. Open a defined alert.
   1. Select the selection icon (![Selection icon.]()) at the top right of the Log viewer tab, and then choose Manage my defined alerts from the drop-down list.
   2. From the Defined alerts table, select the alert that you want to delete.
   {#hla-op-defined-alert-delete-sow__substeps_o4j_ryj_gtb}
3. Select Delete.
{#hla-op-defined-alert-delete-sow__steps_cr1_l2x_stb}

*[\>]: and then