Viewing links between alerts in mixed alert groups
Link View displays the connections between alerts in mixed alert groups in Express List, including how alert attributes relate to each other within the group.
Link View for mixed alert groups shows the connections between alerts in groups that combine different alert group strategies to form a single cohesive group.
To view how different alert groups are visualized in Link View, see the description of Link view for the relevant alert group types. Currently, mixed groups are composed of Tag cluster alert groups, CMDB-based alert groups, related log entities and shared impacted services.
For more information about alerts in the mixed alert group, see Mixed alert grouping.
For more information about Link View for related groups, see Viewing links between alerts in tag-based alert groups, and Viewing links between alerts in CMDB-based alert groups.
The preceding figure shows the Link View of a mixed alert group. The dashed line with the number 1 between the CIs indicates that the CIs aren't connected directly but are separated by a CI in the service map in the CMDB topology. The sample also shows the defining attribute for the correlation, datacenter, linked to the relevant CIs.
The Link View for a mixed alert group that includes related log entities and shared impacted services displays connected nodes representing each correlation source and attribute, including log analytics data, CMDB information, and impacted services. This information gives operators a picture of the scope and nature of the grouping at a glance.
The Link View Display legend lists the meaning of the symbols used to represent the tags and their number of unique nodes. In the legend, defining tags are marked as Correlation. You can toggle between hiding and showing tag types to reduce noise. For a description of each tag, see Attributes in Express List Link View.