Ok so after little to no support i decided to learn python and was able to hack this together.

use this sniplet as the base to build a transform for your situation

c1_router = device.findDevice('colo1_router')
c2_router = device.findDevice('colo2_router')
c3_router = device.findDevice('office_router')
rack1 = '/Colo2/Rack 1'
rack2 = '/Colo2/Rack 2'
rack3 = '/Colo2/Rack 3'
office = '/Office/DC'

if device.id != c1_router and c1_router.getPingStatus() > 0:
     evt.severity = 0
elif device.location().id == rack1 and device.id != c2_router:
     if c2_router.getPingStatus() > 0:
          evt.severity = 0
elif device.location().id == rack2 and device.id != c2_router:
     if c2_router.getPingStatus() > 0:
          evt.severity = 0
elif device.location().id == rack3 and device.id != c2_router:
     if c2_router.getPingStatus() > 0:
          evt.severity = 0
elif device.location().id == office and device.id != c3_router:
     if c3_router.getPingStatus() > 0:
          evt.severity = 0

Layout:
I have 3 data-centers, one at the office and 2 at a collocation facility all connected via VPN tunnels. My zenoss instance is located at one of the collocation facilities.

The problem is every time the tunnel (VPN) flickers you end up with hundreds of alerts and then clear messages.

NOTE: This transform must be placed in /STATUS/PING. This also seems to automatically work for service dependencies as /STATUS/PING messages supersede those

The Code:
LINES 1-3: in the first three lines i define my 3 vpn tunnel gateways (their name as zenoss knows them)
LINES 4-7: define the absolute locations that need to traverse the VPN tunnels to be contacted by the zenoss instance (copied exactly from zenoss)
LINES 8-9: set a condition that if the event is not for local gateway and it is down, suppress the event
LINES 10-21: break down the conditions in such a way that if the alert is for given location and it isn't the VPN gateway for that location, check the status of this gateway and if it isnt responding, suppress the event

The Result:
On every outage it will check if the route is available and if not it will not mass spam you with false positives
NOTE: zenoss will still send an alert for the gateways themselves so you will know there is a problem (unless its just another VPN tunnel flicker, in which case only 2 messages will be generated - an alert and a clear message for the responsible router)

Room For Improvement:
When i get time, i will add my switches for all the racks in there as well so you dont get spammed upon a switch failure either


Hope this helps someone out there :)

I've also added this to the wiki at http://www.zenoss.com/community/wiki/ExampleLayer2DeviceDependencies/

- M S Hundal