itsi_event_grouping

[salinasaritha]

I have 2 alerts open alert and clear alert. both are triggering at different timestamps but they are unable to group into single episode.  what is the root cause

[livehybrid]

Hi @salinasaritha 

We will need a lot more information to be get to the bottom of this. How are you generating these alerts? Do these come from a Notable Event Aggregation Policy (NEAP) to group them? What steps have you taken so far to investigate this? Are both notables reaching the NEAP?

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[salinasaritha]

Hi @livehybrid ,

yes they come from Notable Event Aggregation Policy (NEAP. they are reaching Neap and those are having common criteria as alertname and split by alertname in the neappolicy

[skramp]

Thanks for your request. As you have mentioned you have some alerts, I assume those alerts you can also find in the index itsi_tracked_alerts, right? If so, you want to "bundle" those alerts somehow by a specific criteria. You are right, therefore a NEAP is needed. You can ie say you want to bundle the same alerts by hostname. Do you already have a NEAP which should do this or what was your idea to archive this?