Alert Correlation Rule Not working for Flapping (reopend) alerts - Tag based alert Correlation Rule.

[Pratik Malviya]

Hi ServiceNow Enthusiast,

I have configured an alert correlation rule using Alert Automation in the Service Operations Workspace (SOW). The alert grouping is functioning as expected for newly generated alerts; however, it does not appear to work for older alerts (approximately 30 days old) that have been reopened.

The correlation is based on tags (e.g., location) with a 15-minute time window.

Could you please assist in reviewing this behavior and advise on how it can be addressed? Your support in this matter would be greatly appreciated.

Thank you.

AJ_TechTrek, @Ankur Bawiskar 

[Ankur Bawiskar]

@Pratik Malviya  

not very sure on this part.

[MattSN]

There are a couple of properties to look at 
https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1346251

Also check evt_mgmt.active_interval property

[Pratik Malviya]

Thanks @MattSN ,

However this would affect to all the correlation alert grouping. I want it for specific Alert Correlation rule.