Hello..

See below image

I am getting duplicated events and cannot seem to correlate them down. I have filtering by the Parameter Description field with a wildcard of *34003* (the unique alarm ID) and have tried using a group by element. But they still retain this duplication. Can you please suggest the best wayt to collapse these events into a correlation rule?

So another question. Does correlation rules apply or work with views based upon a sliding Window. I have applied the same correlation rules to the Active view and they correlate correctly.

Thanking you in anticipation.

See enclosed Image:-