Correlation rule – When there is more than 10 alarms – Group by element

Solved1.18K viewsCorrelation group
1
0 Comments

Dear Dataminer Dojo,

In the correlation rules, I was wondering if it is possible to add in this following condition :
- When we have more than 10 alarms on one element, I would like to group those alarms.

I have tried to add the Rule Condition, with count(*) < 10, however it is not related to one element and I wasn't able to group by element in the Rule Condition.

If any one has an idea, do not hesitate.

Thanks in advance,

Laurine

Marieke Goethals [SLC] [DevOps Catalyst] Selected answer as best 18th July 2023

2 Answers

2
8.64K 2 Comments

Hi Laurine, your first step would be to group incoming alarms by element.  Because the evaluation is then done on an element basis.  Can you make sure that this is set up like this at the top of your correlation definition?

Marieke Goethals [SLC] [DevOps Catalyst] Selected answer as best 18th July 2023
Wouter Demuynck [SLC] [DevOps Enabler] commented

as a note: don’t enable the “trigger on single events” checkbox for this rule, as it will not keep track of the active alarms per elements if you do.
Ben Vandenberghe [SLC] [DevOps Enabler] commented

Correct Wouter, well-spotted. Apologies for that, I just wanted to depict the drop down with the selection of that specific ALARM GROUPING option. Thanks!
You are viewing 1 out of 2 answers, click here to view all answers.