Make sure that in the corr search you have the Notable Event Identifier fields set and not just leaving it at 'source'. These fields are used to identify the NE as unique. For instance you might want to use %host%%eventtype%%Message%. This will let ITSI know that the NE is the exact same one as one already created and it will prevent duplicates. When wanting to create a Remedy ticket you will want to make sure that in the Action tab of the Aggregation policy you choose something like When this event occurs: Severity greater than or equal to Medium, and then the action will be to create an event. Agg policies create 1 ticket per episode, not per NE.
... View more