Alert Triggered Not Bonding with Alert Reset Event

[sumanjungay]

As part of POC we are testing the Event Management integration with Solarwinds.

When the Solarwinds send the "Alert Triggered" (in this case Volume high) event type to the SNOW the Alert is getting generated and able to pick the Event Rule which we created. However, when the "Alert Reset" event comes for the same event from Solarwinds, it is not able bond with the "Alert Triggered" Alert and not closing it automatically.

NOTE: The Alert Reset Event is also picking the same Event Rule.

Any suggestions what needs to be adjusted in the Event Rule or else where?

[sumanjungay]

Do you know which field from Solarwinds can update the message key in EM?

Or how we can manipulate the event /Alert on the SW so that it can populate the Message Key in EM?

[Jeff K1]

We don't have Solarwinds as a source in my environment, but I'm assuming you're using the MID Server script include to transform what comes from Solarwinds into what EM needs to have populated.

If so, and if I was onboarding Solarwinds as a source in my environment; I'd work closely with Solarwinds support to determine what is being passed that could/should be concatenated together to make up the message key, and define it in the script include.

One issue with that is that you'd have to participate in Skipped Records review whenever the script include is updated, to make sure you're not missing vital out of the box updates to that script.

If you don't want to deal with that, then I'd go with the Transform and Compose option in the Event Rule. You won't see the message key in the event, but you'll see it where it matters the most, and that's the Alert.