---
sourceDocument: Yokohama IT Operations Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/yokohama/it-operations-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Configure scheduled job-based alert grouping

# Configure scheduled job-based alert grouping {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Set up rules and parameters to group related alerts automatically, streamlining alert management and reducing alert noise.

## Before you begin

Role required: evt_mgmt_admin

## About this task

The scheduled job Service Analytics: Group Alerts Using RCA/Alert Aggregation helps in grouping alerts.

## Procedure

1. Navigate to AllEvent ManagementAdministrationAlert Correlation Properties.
2. On the Alert Correlation Properties page, enable the relevant properties.  
   * Enable CMDB correlation (sa_analytics.agg.query_cmdb_correlation_enabled).
   * Enable Network Traffic correlation (sa_analytics.agg.query_network_traffic_correlation_enabled).
   * Enable ML based Automation correlation (sa_analytics.specific_patterns_enabled).
   * Enable Text based correlation (sa_analytics.text_based_group_enabled).
   * "Group by" property, with comma-separated list of field names that need to have matching values across alerts to allow alerts to be grouped together. The property can contain alert field names (such as assignment_group), CI field names (such as alert_cmdb_ci.location), alert additional info field names (such as additional_info.state) or alert tags (such as t_data_center). When the specified field values match each other between alerts, those alerts can be grouped together (sa_analytics.agg.group_alert_with_same_group_by_fields).
   * Max number of relations between CIs in a topology which form a CMDB group (sa_analytics.agg.query_cmdb_graph_walk_nodes).
   * Use all CMDB relations for CMDB group correlation (evt_mgmt.related_cis_get_all_relation_types).
   {#enable-alert-grouping__ul_vpb_xy3_rcc}
3. Select Save.  
   To group alerts without a CI as Text-based or ML based groups, set sa_analytics.enable_no_ci_grouping to <kbd class="ph userinput">true</kbd>. Ensure the Feature Identifier includes both the node and metric
   name. For details on configuring the feature identifier, see [Specify and manage pattern identifier attributes for alert grouping](https://servicenow-prod.fluidtopics.net/DtD9YwcZD1Nt6cM~cg_8IA "The Alert Aggregation Learner analyzes alerts and identifies patterns using a defined set of alert and configuration item (CI) attributes. By configuring these attributes as pattern identifiers, you can control which characteristics are used to group alerts. This customization creates meaningful alert groups, improving alert management and response times by reducing noise and enabling focus on critical issues.").
4. **Optional:** Set evt_mgmt.alert_groups_reasoning.enable_worknotes to <kbd class="ph userinput">none</kbd> to prevent group reasoning work note display.  
   By default, a work note appears in the Activities tab when a group is created or updated, showing the grouping reason.
{#enable-alert-grouping__steps_upb_xy3_rcc}
**Related concepts**   

* [Automated alert grouping](https://servicenow-prod.fluidtopics.net/FHrJ9kDr_Pm28csw30pnmw "Automated alert grouping is a process that uses historical data to automatically organize similar alerts into groups. These alerts could be system issues, like server errors or network outages. By grouping related alerts together, it helps teams quickly identify patterns, manage recurring problems, and reduce the noise from too many individual alerts.")
* [CMDB based alert grouping](https://servicenow-prod.fluidtopics.net/G3z31fQVC3q~AUNJa2cCfg "CMDB based alert grouping helps organizations manage alerts by organizing them according to their related configuration items (CIs) within the Configuration Management Database (CMDB). This method group alerts based on CI relations in applications or infrastructure components, allowing teams to better understand the impact of issues, respond more effectively to alerts, and maintain service availability.")
* [Text-based alert grouping](https://servicenow-prod.fluidtopics.net/0mC9Nj5J7_c1~eOyLGsfwg "In text-based alert grouping, alerts are organized and correlated based on specific text patterns or keywords within the alert content. This approach dynamically groups alerts that share similar textual characteristics, such as error messages or event descriptions, allowing for more flexible and adaptive management of alerts.")
* [Tag cluster alert grouping](https://servicenow-prod.fluidtopics.net/fL8npuMEzlwKPzApgwzRew "Tag cluster alert grouping enables you to easily create groups of alerts. It is a non-code method of alert grouping that correlates alerts without having to use CMDB or model training. This simpler way of grouping similar alerts reduces the overall noise of a large quantity of alerts.")

*[\>]: and then