First of all, is the following syntax correct to be alerted for the the router/switch name contains *PKS*, I think so since I got the alert notification from testing.
Node Status is equal to Down
System Name contains '%PKS%'
And what happens after the alerts notifications are sent? Because I have another advanced alert set to have the notifications sent to a different group for all the Cisco router/switch down:
Node Status is equal to Down
Vendor is equal to Cisco
Why I asked is because '%PKS%' is part of the Cisco route/switch group. I did get the notifications of all the routers with PKS strings from the
"Vendow is equal to Cisco" alerts but not from the "System Name contains '%PKS%'" alert.