Incident Status Based De-duplication
Incident Status Based De-duplication works on the logic that all alerts that come in for a Service are related to the same issue. So, if there is an open incident for a Service - that is, incident is in the
Acknowledged state, all incidents that come in for this Service will get de-duplicated against the existing, open incident within the specified time window.
- The User Role associated with the user in the Team must have required permissions to manage Services (ability to manage De-duplication Rules).
Enabling the Incident Status Based De-duplication
Enabling this while creating a new Service
Ensure that the right Team is chosen from the team picker on the top of the screen.
(1) Click on Services in the primary navigation. Then, click on Add Service to create a new Service
Here, in addition to the required information, enable the checkbox with the information message and choose the appropriate time window for which you would like this De-duplication Rule to hold true. This can be enabled/modified even after the Service is created.
Note: The maximum time allowed for de-duplication is 48 hours.
Finally, click on Save to create the Service.
By default, Incident Status Based De-duplication checkbox in the Service creation modal will remain unchecked.
(2) After enabling the checkbox and creating the Service, if you click on the More options icon for the Service
Select De-duplication Rules, you will be able to see the De-duplication Rule added for the same.
Enabling this for an existing Service
If you leave the Incident Status Based De-duplication box unchecked at the time of Service creation and want to add this rule later, you can copy and paste the rule below and change the Rule Execution Priority accordingly.
past_incident.is_suppressed == false with the appropriate deduplication time window.
(1) I have added the De-duplication Rule
past_incident.is_suppressed == false manually to an existing Service to de-duplicate all alerts against any open incident for the Service. Nevertheless, I do not see Incident Status Based De-duplication taking place as expected. What am I missing?
Once the De-duplication Rule
past_incident.is_suppressed == false is added manually to an existing Service, please move the rule
down based on the Rule Execution Priority you wish to have. If you do not want any of your other De-duplication Rules to be executed for the Service, move the newly added De-duplication Rule to the top of the list of rules.