Incident Status Based De-duplication

Use Incident Status Based De-duplication to de-duplicate all alerts to an existing open incident for a Service

Incident Status Based De-duplication works on the logic that all alerts that come in for a Service are related to the same issue. So, if there is an open incident for a Service - that is, incident is in the Triggered or Acknowledged state, all incidents that come in for this Service will get de-duplicated against the existing, open incident within the specified time window.

Enabling the Incident Status Based De-duplication

Enabling this while creating a new Service

(1) Navigate to Services from the sidebar

(2) Click on Add Service

(3) Fill in the required details and enable the checkbox at the bottom that says De-duplicate all incoming incidents against any open incident for this service for and specify the De-duplication Time Window. The maximum time allowed for de-duplication is 48 hours.

(4) After enabling the checkbox and creating the Service, if you click on the More option for the Service

Select De-duplication Rules, you will be able to see the De-duplication Rule added for the same.

Enabling this for an existing Service


(1) I have added the De-duplication Rule past_incident.is_suppressed == false manually to an existing Service to de-duplicate all alerts against any open incident for the Service. Nevertheless, I do not see Incident Status Based De-duplication taking place as expected. What am I missing?

Once the De-duplication Rule past_incident.is_suppressed == false is added manually to an existing Service, please move the rule up or down based on the Rule Execution Priority you wish to have. If you do not want any of your other De-duplication Rules to be executed for the Service, move the newly added De-duplication Rule to the top of the list of rules.