sonar-replay-batch-rules

Replay batch rules over a past time range. Enumerates cron fire times of batch rules in the range. By default, outputs the replay plan only (dry run). With run=t, actually runs the rule query at each fire time and raises events and tickets. Constraints: requires administrator privilege, and run=t is rejected on standby nodes. Events are backdated to each fire time, but ticket created/updated times are the current time. Suppression windows are simulated within the replay only, independently of the live suppression state. Signature/ETIR risk scoring is not applied. now(), ago(), and duration= expressions in the rule query are rewritten to constants based on each fire time.

sonar-replay-batch-rules [from=VALUE] [to=VALUE] [duration=VALUE] [guids=VALUE] [run=VALUE] [limit=VALUE]

from=VALUE: Optional. Replay range start time (yyyyMMddHHmmss). Specify from or duration.
to=VALUE: Optional. Replay range end time (yyyyMMddHHmmss, default: now). A future time is truncated to now. The range is limited to 366 days.
duration=VALUE: Optional. Replay range from now (e.g. 7d). Specify from or duration.
guids=VALUE: Optional. Comma-separated batch rule GUIDs (default: all enabled batch rules)
run=VALUE: Optional. Set t to actually run rule queries and raise events and tickets (default: f, dry run). Events are backdated to each fire time, and suppression windows are simulated at fire times. Note that replayed tickets are created for real.
limit=VALUE: Optional. Maximum count of (rule, fire time) pairs (default: 10000)

Output Fields

Field	Type	Name	Description
rule_id	Integer	Rule ID	e.g. 1
rule_guid	String	Rule GUID	e.g. 550e8400-e29b-41d4-a716-446655440000
rule_name	String	Rule name	e.g. Failed login detection
enabled	Boolean	Enabled	e.g. true
schedule	String	Cron schedule	e.g. /5 * * *
fire_time	Date	Fire time	e.g. 2026-09-01 00:05:00
query_from	Date	Query from constant	e.g. 2026-09-01 00:00:00, null if rule duration is not set
query_to	Date	Query to constant	e.g. 2026-09-01 00:05:00
duration	Integer	Rule duration in seconds	e.g. 300
datetrunc	Integer	Rule date truncation in seconds	e.g. 60
dataset_guid	String	Dataset GUID	e.g. 550e8400-e29b-41d4-a716-446655440000, null if the rule query is inlined
query	String	Replay query string	Final query to run, with the sort clause appended. now() and ago() calls are replaced with constants.
constants	Map	Injected constants	e.g. {NOW=2026-09-01 00:05:00}. Query context constants injected on replay.
rewrite_warnings	List	Rewrite warnings	e.g. [ago() with non-literal argument, not replaced]
suppress_key	String	Suppress key	e.g. account
status	String	Replay status	e.g. success. One of success, error, or cancelled. run=t only.
result_count	Long	Query result count	e.g. 10. run=t only.
alert_count	Integer	Alert count	e.g. 3. Count of unique suppress keys merged into alerts. run=t only.
ticket_count	Integer	Ticket count	e.g. 3. Count of distinct tickets related to responded alerts. Depending on the rule ticket issuance condition, a responded alert may not issue a ticket, and a suppressed merge updates an existing ticket instead of creating one. run=t only.
raw_count	Integer	Raw event count	e.g. 10. Count of rows written to the raw event table. run=t only.
suppressed_count	Integer	Suppressed row count	e.g. 2. Count of rows skipped by event suppression. run=t only.
elapsed_ms	Long	Elapsed milliseconds	e.g. 1234. run=t only.
ticket_guids	List	Ticket GUIDs	e.g. [550e8400-e29b-41d4-a716-446655440000]. Distinct ticket GUIDs related to responded alerts. run=t only.
_error	String	Error message	e.g. dataset not found. Null unless the replay item failed.