Hi Dojo Community !
Is there any way, the correlation rule grouping can be done on the base alarm 'value' field ?
Hi ,
So the use case is , we have an alarm that has the same ‘Value’ field (which is the only property available for that timeout alarm) that I want to use to group them together and raise a single correlated alarm. The value only shows the IP address , so I wanted to group all the base alarms with the same IP address into one correlated alarm so the operators can click on the correlated alarm card and have the information of the all the base events collected . The parameter description has just the string ‘ DMA disconnected’ nothing specific to differentiate the alarm which is why I am utilizing that as a filter condition to pick up the base alarms
Hi,
would it be an option to use Automatic Incident Tracking instead of Correlation?
That feature is able to group timeout alarms with the same polling IP and it will do so by default once enabled.
More info can be found here.
Hi A B M,
As Miguel stated, I do not believe we can do the correlated alarm off of the Base alarm. However, would a custom element property work in your case. Where you can set a custom property on the elements for the purpose of correlating them together. Then set your correlation rule Alarm Filter to match the desired severity (TimeOut) and custom property set. In example below, I filtered on all alarm levels and the custom property Asse Model set to 'MS'.
Thank you Steve for the answer ! I will test it out and see if it is viable workaround for my specific use case .
Hi,
As far as I know it is not possible. However, please could you elaborate your use case? Maybe it is possible to use another grouping