Scheduled jobs and parameters for alert grouping

concept australia Updated Sep 10, 2026 2 min read alert-grp-jobs-parameters.md
Raw file servicenow.com

Automate alert organization by configuring jobs to group alerts based on predefined criteria and parameters.

To group alerts in Automated, CMDB, Text-based, Tag Cluster, and Network Traffic Correlation groups, the scheduled job named Service Analytics group alerts using RCA/Alert Aggregation is typically run once per minute. This job handles the grouping of alerts based on the specified method. Additionally, you can run multiple scheduled jobs in parallel to manage alert grouping more efficiently. For further details, see Run multiple scheduled jobs for alert grouping.

To define which alerts are grouped, the following parameters are used:

  • sa_analytics.aggregation_enabled: This parameter enables alert grouping created by the schedule job. Set the property Enable alert aggregation for Automated, CMDB, and Text-Based groups to true to activate this feature.

    Note: This property also applies to Tag Cluster and Network Traffic Correlation grouping.

  • sa_analytics.agg.query_dynamic_window: By default, this is set to 10 minutes (600 seconds). It defines the maximum time difference allowed between the last event generation times of two alerts that can be grouped together.

  • sa_analytics.agg.query_max_group_lifetime: Maximum time from the first alert to the last alert in a group. The default is 30 minutes (1800 seconds). If events arrive with a delay exceeding this period, the sa_analytics.agg.group_expiration_time parameter can be used to extend the grouping time beyond 30 minutes.

Note: Some parameters, such as sa_analytics.agg.query_dynamic_window, sa_analytics.agg.query_max_group_lifetime, and sa_analytics.agg.group_expiration_time, are not provided out of the box. To use these properties, you need to create properties with the same names and assign the required values to them. For more information on how to create a property, see Add a system property.

Example: How alerts are grouped

For tag-cluster grouping, alerts are added to a group based on the timeframe parameter defined in the alert tag clustering settings. For automated, CMDB, and text-based, network traffic grouping, alerts are aggregated as follows.

Consider the following alerts with the same CI. (All of them may be added to the same CMDB group).

  • Alert1: Initial event generation at 01:00:00 AM
  • Alert2: Initial event generation at 01:11:00 AM
  • Alert3: Initial event generation at 01:13:00 AM
  • Alert4: Initial event generation at 01:16:00 AM
  • Alert5: Initial event generation at 01:25:00 AM
  • Alert6: Initial event generation at 01:34:00 AM
  • Alert7: Initial event generation at 01:43:00 AM

Alert1 and Alert2 are not grouped due to the time gap exceeding 10 minutes. Alert2 and Alert3 create a group at 01:13:00 AM. The 10-minute dynamic window starts at 01:13:00 AM, with the following:

  • Alert4 is added to the group at 01:16:00 AM, restarting the 10-minute window.
  • Alert5 and Alert6 are added to the group as their event times are within the 10-minute window.
  • Alert7 is not added because it arrives 9 minutes after Alert6, exceeding the 30-minute group lifetime from initial group creation (01:13:00 AM + 30 minutes = 01:43:00 AM).

Note: After an alert is created, correlation logic is applied only once. Changes to the alert after its creation are not re-evaluated for correlation. If correlation is not established initially, the alert may still be added to a group later—but only if a new incoming alert matches and triggers grouping logic.

Search documentation
Search document titles and file paths on the australia branch