--- sourceDocument: Australia IT Operations Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia IT Operations Management ft:clusterId : - itom bundleId : - itom workflow : - Technology --- # Scheduled jobs and parameters for alert grouping # Scheduled jobs and parameters for alert grouping {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Scheduled jobs and parameters for alert grouping ServiceNow enables automated organization of alerts by configuring scheduled jobs that group alerts based on predefined criteria and parameters. This grouping improves alert management efficiency by consolidating related alerts into meaningful groups such as Automated, CMDB, Text-based, Tag Cluster, and Network Traffic Correlation groups. Show full answer Show less ## Key Features * **Scheduled Job for Alert Grouping:** The *Service Analytics group alerts using RCA/Alert Aggregation* job runs typically once per minute to process and group alerts according to the selected grouping method. * **Parallel Job Execution:** Multiple scheduled jobs can be run concurrently to handle alert grouping more efficiently in high-volume environments. * **Configurable Parameters:** Alert grouping behavior is controlled by system properties, which must be created if not provided out of the box: * **saanalytics.aggregationenabled:** Enables alert grouping when set to true. This activates grouping for Automated, CMDB, Text-Based, Tag Cluster, and Network Traffic Correlation groups. * **saanalytics.agg.querydynamicwindow:** Defines the maximum allowed time difference between the last event times of two alerts to be grouped, defaulting to 10 minutes (600 seconds). * **saanalytics.agg.querymaxgrouplifetime:** Sets the maximum lifespan of a group from the first to the last alert, defaulting to 30 minutes (1800 seconds). * **saanalytics.agg.groupexpirationtime:** Optional property to extend group lifetime beyond the default 30 minutes, useful for delayed event arrivals. * **Property Creation:** Since some parameters are not included by default, customers must add these system properties manually with the desired values. ## How Alert Grouping Works Alerts are grouped based on timing and correlation criteria specific to the grouping method: * **Tag-Cluster Grouping:** Alerts are clustered based on a timeframe defined in the alert tag clustering settings. * **Automated, CMDB, Text-Based, and Network Traffic Grouping:** Alerts related to the same Configuration Item (CI) are aggregated if their event generation times fall within the dynamic window and group lifetime parameters. For example, if alerts occur within 10 minutes of each other and the total group duration does not exceed 30 minutes, they will be grouped together. Alerts arriving outside these windows are not grouped. ## Important Considerations * Correlation logic applies only once at alert creation; updates to an alert do not trigger re-evaluation. * An alert not initially correlated may be grouped later if a new alert matches grouping criteria, triggering the grouping process. This configuration allows ServiceNow customers to effectively manage alert volumes by consolidating related alerts into actionable groups, improving incident management and response efficiency. Automate alert organization by configuring jobs to group alerts based on predefined criteria and parameters. To group alerts in Automated, CMDB, Text-based, Tag Cluster, and Network Traffic Correlation groups, the scheduled job named Service Analytics group alerts using RCA/Alert Aggregation is typically run once per minute. This job handles the grouping of alerts based on the specified method. Additionally, you can run multiple scheduled jobs in parallel to manage alert grouping more efficiently. For further details, see [Run multiple scheduled jobs for alert grouping](https://www.servicenow.com/docs/yJAMkmYA6OzBV0GvqDFXjg "Run multiple scheduled jobs in parallel to group alerts. This helps prevent overwhelming the system during surges (alert storms)."). To define which alerts are grouped, the following parameters are used: * sa_analytics.aggregation_enabled: This parameter enables alert grouping created by the schedule job. Set the property Enable alert aggregation for Automated, CMDB, and Text-Based groups to true to activate this feature. Note: This property also applies to Tag Cluster and Network Traffic Correlation grouping. * sa_analytics.agg.query_dynamic_window: By default, this is set to 10 minutes (600 seconds). It defines the maximum time difference allowed between the last event generation times of two alerts that can be grouped together. * sa_analytics.agg.query_max_group_lifetime: Maximum time from the first alert to the last alert in a group. The default is 30 minutes (1800 seconds). If events arrive with a delay exceeding this period, the sa_analytics.agg.group_expiration_time parameter can be used to extend the grouping time beyond 30 minutes. {#alert-grp-jobs-parameters__ul_i4c_rv5_hcc} Note: Some parameters, such as sa_analytics.agg.query_dynamic_window, sa_analytics.agg.query_max_group_lifetime, and sa_analytics.agg.group_expiration_time, are not provided out of the box. To use these properties, you need to create properties with the same names and assign the required values to them. For more information on how to create a property, see [Add a system property](https://www.servicenow.com/docs/access?context=t_AddAPropertyUsingSysPropsList&version=australia&pubname=australia-platform-administration&ft:locale=en-US). ## Example: How alerts are grouped {#alert-grp-jobs-parameters__section_vmv_xx5_hcc} For tag-cluster grouping, alerts are added to a group based on the timeframe parameter defined in the alert tag clustering settings. For automated, CMDB, and text-based, network traffic grouping, alerts are aggregated as follows. Consider the following alerts with the same CI. (All of them may be added to the same CMDB group). * Alert1: Initial event generation at 01:00:00 AM * Alert2: Initial event generation at 01:11:00 AM * Alert3: Initial event generation at 01:13:00 AM * Alert4: Initial event generation at 01:16:00 AM * Alert5: Initial event generation at 01:25:00 AM * Alert6: Initial event generation at 01:34:00 AM * Alert7: Initial event generation at 01:43:00 AM {#alert-grp-jobs-parameters__ul_scp_wx5_hcc} Alert1 and Alert2 are not grouped due to the time gap exceeding 10 minutes. Alert2 and Alert3 create a group at 01:13:00 AM. The 10-minute dynamic window starts at 01:13:00 AM, with the following: * Alert4 is added to the group at 01:16:00 AM, restarting the 10-minute window. * Alert5 and Alert6 are added to the group as their event times are within the 10-minute window. * Alert7 is not added because it arrives 9 minutes after Alert6, exceeding the 30-minute group lifetime from initial group creation (01:13:00 AM + 30 minutes = 01:43:00 AM). {#alert-grp-jobs-parameters__ul_tcp_wx5_hcc} Note: After an alert is created, correlation logic is applied only once. Changes to the alert after its creation are not re-evaluated for correlation. If correlation is not established initially, the alert may still be added to a group later---but only if a new incoming alert matches and triggers grouping logic.