Questions about Knowledge Gap Identification incident clustering

[jsouth]

We are evaluating Knowledge Gap Identification in Knowledge Center and are trying to better understand how incidents are grouped into potential knowledge gaps.

We are seeing very different results between groups. For example, one group contained around 50 nearly identical monitoring incidents, which made sense. Other groups contain incidents that are only broadly related, with different issues, causes, and resolutions.

I’m hoping someone can clarify how this functionality is intended to work:

1. What information is used to group incidents together? Does it consider fields such as Short Description, Description, Resolution/Close Notes, category, CI, assignment group, or something else?
2. Does it consider the incident resolution when determining similarity? We are seeing incidents grouped together that may describe similar symptoms but have substantially different resolutions.
3. Is the similarity or clustering threshold configurable? If so, where is this configured? Are there recommended settings or practices for improving the relevance of the groups?
4. Can certain incidents be excluded from gap identification? For example, can automated or monitoring-generated incidents be excluded through conditions or filters?
5. How is the Group Description generated? It appears in some of our testing that the description may be based on the first incident in the group rather than a summary of the entire group. Is that expected?
6. What is the recommended way to handle an inaccurate group? If incidents have been grouped together but do not represent the same knowledge need, is there a way to correct or refine the grouping?
7. Do actions taken on groups affect future results? For example, does marking a group as a gap, resolving it, or determining that it is not a gap provide feedback that affects future clustering?

Ultimately, we are trying to determine how much administrators can influence the quality of these groups and what the expected process is for handling inaccurate clusters.