Event Management Event Rules Threshold function
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
4 weeks ago
Hi All...
We decided to give Event Rules Thresholds a go.
After reading the documentation, which says it will use the "number of occurrences over a specified period", we discovered this wasn't true, and instead it uses the "specified period" as a rolling window as it compares the current Event time_of_event field to a 'Threshold Staging' record 'Last Event Time' which holds the previous Event time_of_event value.
That 'Threshold Staging' record does have the 'Initial Event Time' so converting this rolling window to a static should be too difficult.
I have created this Idea, but havent had much luck with previous ones, so I'm asking for your help with this one.
Cheers...
Pablo.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
2 weeks ago
Hello @Pablo Garbarino,
Please refer to the links below:
https://www.servicenow.com/docs/bundle/yokohama-it-operations-management/page/product/event-manageme...
If it is helpful, please hit the thumbs-up button and accept the correct solution by referring to this solution in the future. It will be helpful to them.
Thanks & Regards,
Abbas Shai
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
a week ago
Hi Abbas, this is the current functionality documentation and it does not perform in the way described in the Idea.
We have multiple tickets around this including one to update the documentation, which looks to have been updated, but it still doesnt explain how the COUNT process actually runs.
The current functionality works as a rolling window. As in, if you have a Threshold with "Count" of 3 "Over" 10mins, an Alert could be generated 30 mins after the FIRST Event if events were received every 10mins.
The Idea is to provide us with an option for a Static Window by comparing the current Event "time_of_event" field to the "Initial Event Time" field on the corresponding "Threshold Staging" record, which holds the value of the FIRST Event "time_of_event" field, instead of the "Last Event Time" field, which holds the LAST Event "time_of_event" value.
By using "Initial Event Time", we would only get an Alert if there are 3 Events WITHIN 10mins instead of 30mins.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
a week ago
I gave it a look and an upvote. I'm all for better control on how we define our Event Rules.
