Assistance with advanced alert suppression

qle

I know thi is the Nth post asking for assistance with alert suppression but please bear with me. Let's say I have a remote site with a router and one server behind it. Obviously, I want to suppress the server alert if the router goes down. We've standardized the node names as follows:



Router is named _Router, e.g. Chicago_Router

Server is named _Server, e.g. Chicago_Server



However, we have ~85 sites setup as such. For the sake of maintenance, I'd like to minimize the number of alert definitions that need to be created for this. As it is, I have two alert definitions that go off when any one of the routers or servers go down.



Ideally, I'd like to define an alert suppression for the server alert such that it extracts from the node name and suppresses the alert if _Router is down. Short of creating ~86 alerts (1 for the routers and 85 for each server), does anyone have a suggestion to handle this?