---
sourceDocument: Australia IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Text-based alert grouping

# Text-based alert grouping {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Text-based alert grouping

Text-based alert grouping in ServiceNow Event Management enables dynamic organization and correlation of alerts based on shared text patterns or keywords within alert content, such as error messages or event descriptions.
This method leverages the EM Alert Clustering Solution and a machine learning (ML) Predictor to cluster alerts by analyzing fields like Description, Metric name, and Configuration item.Class.
The ML Predictor asynchronously assigns new alerts to these clusters in near real-time, improving alert management efficiency by reducing noise and consolidating related alerts.
Show full answer Show less  

## Key Features

* **EM Alert Clustering Solution:** Uses Natural Language Processing (NLP) to identify and cluster alerts with similar textual characteristics.
* **ML Predictor:** Assigns incoming alerts to appropriate clusters asynchronously, with alert grouping jobs running once per minute.
* **Configurable Thresholds:**
  * **Cluster quality threshold (default 70):** Ensures clusters meet a minimum similarity quality before being considered valid.
  * **Alert rank threshold (default 0.3):** Filters alerts within a cluster based on similarity rank to maintain grouping accuracy.
* **Requirements:** Predictive Intelligence plugin (com.glide.platformml) must be installed and the EM Alert Clustering Solution definition activated.

## Practical Application

For example, during widespread network connectivity issues, text-based alert grouping consolidates multiple alerts like "Network segment down" or "High packet loss" into meaningful clusters. This grouping helps network engineers quickly pinpoint and address root causes by providing a consolidated and prioritized view of related alerts.

## Management and Configuration

* The EM Alert Clustering Solution definition is found under **Predictive Intelligence \> Clustering \> Solution Definitions**.
* To disable text-based alert grouping, set the system property **saanalytics.textbasedgroupenabled** to false and deactivate the solution definition.
* System properties controlling thresholds must be created with specific names to activate their effects.  
In text-based alert grouping, alerts are organized and correlated based on specific text patterns or keywords within the alert content. This approach dynamically groups alerts that share similar textual characteristics, such as
error messages or event descriptions, allowing for more flexible and adaptive management of alerts.  
The EM Alert Clustering Solution is a method used to correlate alerts based on similarities in specific fields and form clusters or groups. In ServiceNow Event Management, it creates clusters based on the Description, Metric name, and Configuration item.Class fields. This solution organizes alerts into text-based groups, and when a new alert arrives, the ML Predictor identifies the appropriate cluster, grouping alerts within the same cluster.  
Note:  
The ML Predictor job is asynchronous and assigns real-time alerts to clusters, which may result in slight delays. This delay can cause text-based groups to be created several minutes later, as the alert grouping job runs once per minute. If prediction results are not available during a run, they are rechecked in the next grouping job.

For text-based logic to execute, you must have the Predictive Intelligence plugin (com.glide.platform_ml) installed and the EM Alert Clustering Solution definition activated.  
There are specific settings or limits used to control the behavior of text-based alert grouping. These thresholds define the criteria for how alerts are grouped based on text patterns or attributes. The text-based thresholds are:

* Cluster quality threshold: The Cluster quality threshold (sa_analytics.alert_grouping_tb_cluster_quality_threshold) determines the minimum quality required for an alert cluster to be considered valid. This threshold ensures that only clusters with a minimum level of similarity and reliability are used. Clusters that meet this threshold are considered valid, improving the precision of the groupings and reducing noise from irrelevant or low-quality clusters. The range of the threshold is from 1 to 100 and the default value is 70.
* Alert rank threshold: The Alert rank threshold (sa_analytics.alert_grouping_tb_alert_rank_threshold) defines the minimum rank required for an alert to be included in a group. This threshold ensures that only alerts with a certain level of similarity are grouped together, filtering out lower-ranked alerts to maintain the quality of the alert group. The default value is 0.3, where smaller values indicate better similarity.

{#text-based-alert-groups__ul_chs_g53_ncc}  
Note:  
To use these properties, you need to create properties with the same names and assign the required values to them. For more information on how to create a property, see [Add a system property](https://www.servicenow.com/docs/access?context=t_AddAPropertyUsingSysPropsList&version=australia&pubname=australia-platform-administration&ft:locale=en-US).

The EM Alert Clustering Solution definition is located in the \[ml_capability_definition_clustering\] table. To access it, navigate to Predictive IntelligenceClusteringSolution Definitions.

To verify if the solution definition is active, see [Verify text-based clustering solution](https://www.servicenow.com/docs/jh1sl3UmK8ZMdxXuBEeoeA "Event Management uses Natural Language Processing (NLP) algorithms to identify common text patterns in alerts and create alert groups through clustering. This approach not only organizes similar alerts efficiently but also reduces noise and helps focus on significant issues, enhancing overall alert management."). To disable the EM Alert Clustering Solution definition, set the property sa_analytics.text_based_group_enabled to <kbd class="ph userinput">false</kbd>. Then clear the Active check box in the EM Alert Clustering Solution definition.

## Example of text-based alert grouping {#text-based-alert-groups__section_srr_bw3_ncc}

{#text-based-alert-groups__table_ncc_lw3_ncc__entry__2}

| Scenario | Example |
|-|-|
| Network Connectivity Problems: There are widespread network connectivity issues affecting multiple departments. | Alerts from various network monitoring tools might report issues like Network segment down, High packet loss, or Connectivity issues in subnet. Text-based alert grouping uses the EM Alert Clustering Solution and ML Predictor to streamline alert management. The EM Alert Clustering Solution employs Natural Language Processing (NLP) algorithms to analyze and identify common text patterns in alerts. These patterns include issues such as Network segment down or High packet loss. It then clusters these alerts based on their text similarity, grouping related issues together. The ML Predictor further enhances this process by evaluating new alerts in real time and assigning them to the appropriate existing clusters based on their text patterns. This dynamic grouping provides a consolidated view of the connectivity problems, allowing network engineers to quickly diagnose and address the root cause of the issues more efficiently. |
[ ]

{#text-based-alert-groups__table_ncc_lw3_ncc}

*[\>]: and then