I have applied this filter on alarms with a specific alarm ID and then correlating these alarms on a per element basis. However looking at the output we see multiple alarms per element which haven't correlated.
Below is the rule that has been added.
as requested by Michaël I have attached the actions.
Marieke Goethals [SLC] [DevOps Catalyst] Selected answer as best 11th July 2023
Hi Ryan,
Since you're grouping per element anyway, I'd advise to leave the "correlate across DMAs" checkbox unchecked. (all alarm events that need to be grouped together are originating from the same element/agent)
This correlation rule is supposed to combine all of the simultaneously active *34003* alarms for an element together in one correlated alarm event on that same element. I'm not seeing any obvious configuration errors in the screenshots.
Marieke Goethals [SLC] [DevOps Catalyst] Selected answer as best 11th July 2023