10.1.15.12-06212024

Define Incident Merging Settings

Often multiple tickets are related and can be caused by the same root cause. TAF allows you to merge API calls for all these tickets into one Incident instead of creating a new incident for each of these calls.

Configure the following settings to merge Incidents:

  • The option to Enable Incident Merging.
  • The option Match Existing Incident Only:
    • Enabled: API calls belonging to this Incident type will be discarded if no existing incident matches this API call.
    • Disabled: A new incident will be created if no incident matches the API call.
  • New Incident Settings:

You can customize this subject by typing any text and inserting any data field from the category and built-in special fields ({Incident Type}, {source}, {category}, and {triggered time}).

The default incident subject is {source} - {triggered time}.
 Example: You can create a subject: Interface {interface name} of device {device} is down: from {source} on {triggered time}.

Enable Incident Portal: An incident portal will be generated.

  • Merge into Incident by Signature:

You can select one or multiple data fields (or custom variables ) as the signature to merge the tickets to an incident.

  1. Click Add New Value.
  2.  Select a variable from the drop-down list.
  3. (When one value has multiple variables) Click Add Alternative to add an alternative.
    Example: value 1 = Configuration_itemName or $device.
    The use case for the multiple variables is that a ticket may use either Configuration_itemName or $device as the device name reporting this Incident.
    Information Tip: The system will use the first variable with no empty value for the comparison.
  1. When you want to delete a value, click .
  2. You can define multiple values for the signature.

Example: For Interface Error incident type, you may define $device_name as value 1 and $interface_name as value2. The tickets will be merged if both $device_name and $interface_name are the same. 

  • Merge Incident by Time:
    You can define how long TAF should look back to find the incident candidate to be merged.
    • Incident Creation Time
    • Updated Time
      Information Tip: When both times are selected, the system will use AND logic. If neither is selected, the system will search for all incidents.