Event Correlation in ServiceNow Event Manager

[Ganesh Suresh1]

Hello Community,

I'm new to snow event manager and working on Jakarta version on ServiceNow with Event Management Plugin enabled.

Requirement: Correlate Switch down events with the underlying connected CI's host down events.

Cause Event: Switch Event and Effect events: Whichever CIs connected under that switch.
I can see the top-down discovery of the switch and its connected CIs.
How to build a correlation to get single Alert created for Cause event and Effect events should be correlated with same cause event.

Can we do this?
Should we write any kind of correlation rule for this requirement? If yes? why and how? (Since relationship information is already visible on CMDB)

Thanks,
Ganesh

[robertgeen]

Yes you can create correlation rules for this. There are 2 ways you can do this (you will have to test which one will work for you). For the parent event add filters to match a switch down event that will come in. In the child rule add your filter for the ones you want to match to you it (I would suggest to make it easier have types setup for each of the types you want so you can just easily say where type = this and type = that). For the CI relationship do Primary is the parent.

If this doesn't work then you can always use advance mode and create a script to pull the information out the way you would want. Hope this helps.

[craigsnowadmin2]

Can event management plugin be used first  without service mapping for event integration with external monitoring tools like splunk , solarwinds using the connector ?   Or is it better to wait till service mapping is implemented before doing event management?  

 We want to finish discovery implementation and then implement service mapping next year , But we do want to use event management to integrate with other tools now  ? experts suggestions?

[Ganesh Suresh1]

Event Management can be enabled any time, it does not have any dependency on service mapping.

Event Management + Service Map will give a better view of the business services which you have configured.

Thanks,

Ganesh