--- sourceDocument: Australia IT Operations Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia IT Operations Management ft:clusterId : - itom bundleId : - itom workflow : - Technology --- # Understanding pattern identifiers # Understanding pattern identifiers {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Understanding pattern identifiers Pattern identifiers in ServiceNow are criteria or attributes, such as alert type or affected system, used to group similar alerts. This grouping highlights recurring issues, enabling teams to respond efficiently and address ongoing problems. By consolidating related alerts, pattern identifiers improve issue identification and streamline incident management. Show full answer Show less ## How Pattern Identifiers Group Alerts Alerts are grouped based on shared attribute values like Metric Name and Configuration Item (CI). For example, multiple alerts about high CPU usage on the same server are grouped together, indicating a persistent issue. Alerts with differing attributes, such as different metrics or CIs, are kept separate to maintain clarity. ## Configuring Effective Pattern Identifiers * **Create an event rule:** Define event rules to populate alert fields relevant for pattern identification. * **Manage pattern identifiers:** Add appropriate alert fields as pattern identifier attributes and deploy the configuration to activate it. * **Choose relevant identifiers:** Select alert fields that clearly indicate problems, avoiding overly unique fields (like date) or overly common fields that reduce grouping effectiveness. The default pattern identifier is the Metric Name, which can be customized based on your alert data. ## Alert Grouping with Learned Patterns When alerts share matching pattern identifier attributes, they form "Learned Patterns," which are viewable in the Learned Patterns report within Event Management. This facilitates trend analysis and proactive issue handling. ## Managing Pattern Attributes and Time Frame * **Single active attribute set:** Only one set of pattern identifier attributes is active at any time; deploying a new set replaces the previous one. * **Time frame for grouping:** Patterns are identified based on alerts from the last 30 days, configurable via system properties. * **Issue identification:** Alerts are considered similar if they share the same CI and pattern identifier, even if other fields differ. Additional configuration options support grouping alerts by custom fields such as CI Location or enable grouping alerts without CIs by treating nodes as CIs. These enable more flexible and comprehensive alert pattern analysis. A pattern identifier is a set of criteria or attributes (such as alert type, affected system, etc.) used to group similar alerts. It helps to identify recurring issues, making it easier for teams to respond and address ongoing problems. ## How pattern identifiers group alerts {#pattern-identifiers-grouping__section_tj5_zs5_mdc} Consider a network monitoring system that generates alerts for various issues, such as high CPU usage, memory leaks, or connection timeouts. Pattern Identifier: Metric Name and CI * Alert 1: High CPU usage on Server A at 10:00 AM * Alert 2: High CPU usage on Server A at 10:05 AM * Alert 3: Memory leak on Server B at 10:10 AM * Alert 4: High CPU usage on Server A at 10:15 AM {#pattern-identifiers-grouping__ul_k35_ct5_mdc} In this case, the pattern identifier could be set to the Metric Name (e.g., high CPU usage) combined with the Configuration Item (CI) (e.g., Server A). Alerts 1, 2, and 4 would be grouped together because they share the same metric (high CPU usage) and the same CI (Server A), indicating a recurring issue that may need further investigation. Alert 3, however, would not be included in this group because it has a different metric (memory leak) and CI (Server B). Note: The set of alert fields used for the pattern identifier is also referred to as Feature Identifier Attributes or simply attributes. ## How to configure effective pattern identifiers {#pattern-identifiers-grouping__section_enl_nt5_mdc} To configure effective pattern identifiers for alert grouping, follow these three key steps to ensure accurate and meaningful analysis of alerts. {#pattern-identifiers-grouping__table_x1p_wt5_mdc__entry__3} | Step | Action | Description | |-|-|-| | Create an event rule | Define an event rule. To know how to create an event rule, see [Create or edit an event rule](https://www.servicenow.com/docs/LO~TxHZ5iImFpp0Q7z71uQ "You can create event rules to generate alerts for tracking and remediation. Use team-based integrations in event rules to make sure that connector ownership and execution of rules give precedence to general rules. Teams can maintain consistency and hierarchy while offering flexibility and customization options."). | Set up an event rule to populate the relevant alert fields for the pattern identifier. | | Manage pattern identifier | Add relevant alert field to the pattern identifier. To know how to add fields to the pattern identifier, see [Manage pattern identifier attributes for alert grouping](https://www.servicenow.com/docs/I9fGL_Hz~H9q4uOfKc9vew "The Alert Aggregation Learner analyzes alerts and identifies patterns using a defined set of alert and configuration item (CI) attributes. By configuring these attributes as pattern identifiers, you can control which characteristics are used to group alerts. This customization creates meaningful alert groups, improving alert management and response times by reducing noise and enabling focus on critical issues."). | After adding the relevant alert fields, select Deploy to activate the pattern identifier. | | Choose relevant identifiers | Select alert fields that clearly identify the problem. For example, if the issue is that a service is offline or there's no connection to the database, look for specific values in the alert that indicate this. Add these types of fields to the pattern identifier. By default, we provide the Metric Name field as a pattern identifier. | * Avoid overly unique fields (e.g., date) that make pattern identification difficult. * Avoid overly common fields that result in too many alerts being grouped together, making patterns indistinguishable. {#pattern-identifiers-grouping__ul_rkw_155_mdc} | [ ] {#pattern-identifiers-grouping__table_x1p_wt5_mdc} ## Alert grouping and Learned Patterns {#pattern-identifiers-grouping__section_rgg_l55_mdc} Learn how alert patterns are discovered, grouped, and displayed in the system.{#pattern-identifiers-grouping__table_p1z_455_mdc__entry__2} | Concept | Description | |-|-| | Pattern discovery | When alert fields match, the alerts are grouped into a "Learned Pattern" --- for example, alerts sharing the same Priority Group and Resource. | | Pattern reporting | These patterns are displayed on the Learned Patterns report found under Event ManagementAdministrationLearned Patterns. | [ ] {#pattern-identifiers-grouping__table_p1z_455_mdc} ## Managing Pattern Attributes and Time Frame {#pattern-identifiers-grouping__section_j4h_v55_mdc} Learn the process of managing pattern identifier attributes, deployment of new sets, and how the system identifies issues.{#pattern-identifiers-grouping__table_kks_w55_mdc__entry__2} | Concept | Description | |-|-| | Active pattern identifier attributes | Only one set of attributes can be active at a time. Note: The new set replaces the current one after deployment. | | Purpose and time frame | Pattern grouping identifies issues within the last 30 days, controlled by the sa_analytics.agg.learner_period_days property. | | Issue identification | To identify an issue, the system utilizes a combination of Configuration Items (CIs) and Pattern Identifiers (sometimes referred to as Feature Identifiers). By default, a Pattern Identifier is defined as the Metric Name, but this can be modified. Two alerts are considered similar if they share the same CI and Pattern Identifier, although fields such as Source, Severity, Description, and others may differ. For more information, see [Manage pattern identifier attributes for alert grouping](https://www.servicenow.com/docs/I9fGL_Hz~H9q4uOfKc9vew "The Alert Aggregation Learner analyzes alerts and identifies patterns using a defined set of alert and configuration item (CI) attributes. By configuring these attributes as pattern identifiers, you can control which characteristics are used to group alerts. This customization creates meaningful alert groups, improving alert management and response times by reducing noise and enabling focus on critical issues."). Note: The Alert Aggregation Learner also identifies patterns of alerts within manual alert groups. In some cases, you can create patterns from alerts where the CIs share the same value in a specified field. For example, to build patterns from alerts with the same CI Location field, enter location in the sa_analytics.agg.learner_group_by_property property. For more information, [Configure scheduled job-based alert grouping](https://www.servicenow.com/docs/_cgbUbAMrpcpUVa0YGIqWw "Set up rules and parameters to group related alerts automatically, streamlining alert management and reducing alert noise."). When working with CI-based groups, ensure that the pattern identifier includes both the node and the metric name. For details on configuring the Feature Identifier, see [Learned patterns report](https://www.servicenow.com/docs/hke01VfP4tckVLdOBSGFsQ "The Learned Patterns report helps assess the efficiency of alert aggregation and identify recurring alert patterns. It enables proactive issue resolution, enhancing overall system performance by providing insights into frequent alerts."). Note: Alerts that lack a CI can still be grouped together as Text-based or CI-based alert groups, treating a node as a CI. To enable this functionality, set the sa_analytics.enable_no_ci_grouping property to true. | [ ] {#pattern-identifiers-grouping__table_kks_w55_mdc} *[\>]: and then