Hi Dojo,
we're evaluating the performance of our correlation rules on a sample system,
in this case to aggregate alarms for a specific site monitored via DataMiner.

Looking for some clarity around the difference (if any) between:

- the "Source" of an alarm
(as defined in Alarm Console)

and

- the "SourceID" of an alarm
(as defined here and fetched via the values offloaded from the local Cassandra on the DMA
to the central DB, which is MySQL)

Essentially, is the following "transformation" always true when offloading alarm data?
LocalDB/Source="Correlation Engine"-->OffloadDB/SourceID = "23"

As shown in the screenshot below, we've come across a scenario where we get
only 3 "correlated" alarms with "Source = Correlation Engine"
when we perform a history search in a given day (13/07/2023) via the alarm console,
however the result of the query on the offloaded data for the same site and the same day gives us
a total of 583 alarm events where "SourceID = 23"

We're quite happy with the level of aggregation reached (as you can see at the bottom of the console, there were more than 1600 alarms for the site on that day), however when it comes to explaining the 3 VS 583 we've been scratching our head a bit: any steer will be helpful

Many thanks