When you've set alert tags and Event Management has generated an alert group based on tag-based rules, Link View offers a visual representation of the relationships between the alerts in the group. The colored tags in the view represent Configuration Items (CIs) and other environment items in relation to the alerts.

In this example, the defining tag for the correlation, Application, is linked to the tags of the relevant CIs. However, a correlation can be defined by any tag or combination of two tags, such as Resource and Metric name. When the defining tag is missing from Link View, the correlation was based on information that is not represented in the view, such as the description. Each CI node is further linked to the tags that appeared on the same alert as that CI.

In an alert group that was generated from tag rules, nodes connected by a dashed line signify an approximate, "fuzzy" match. This means that the nodes were correlated when the match on the tag rule was not exact, but close enough to be significant. For example, this could happen when a location, email address, or IP pattern was similar enough to qualify as a match.

The Link View legend lists the meaning of the symbols and colors used to represent the tags and their number of unique nodes. In the legend, defining tags are marked as Correlation. You can toggle between hiding and showing tag types to reduce noise. For a description of each tag, see Attributes in Express List Link View.