Configure scheduled job-based alert grouping

task australia Updated Sep 10, 2026 2 min read enable-alert-grouping.md

Set up rules and parameters to group related alerts automatically, streamlining alert management and reducing alert noise.

Before you begin

Role required: evt_mgmt_admin

About this task

The scheduled job Service Analytics: Group Alerts Using RCA/Alert Aggregation helps in grouping alerts.

Procedure

Navigate to All > Event Management > Administration > Alert Correlation Properties.
On the Alert Correlation Properties page, enable the relevant properties.
- Enable CMDB correlation (sa_analytics.agg.query_cmdb_correlation_enabled).
- Enable Network Traffic correlation (sa_analytics.agg.query_network_traffic_correlation_enabled).
- Enable ML based Automation correlation (sa_analytics.specific_patterns_enabled).
- Enable Text based correlation (sa_analytics.text_based_group_enabled).
- Group by property, with comma-separated list of field names. Alerts can be grouped together when the specified field values match each other. The property can contain alert field names (such as assignment_group), CI field names (such as alert_cmdb_ci.location), or alert additional info field names (such as additional_info.state). It can also contain alert tags (such as t_data_center). Property: sa_analytics.agg.group_alert_with_same_group_by_fields.
- Max number of relations between CIs in a topology which form a CMDB group (sa_analytics.agg.query_cmdb_graph_walk_nodes).
- Use all CMDB relations for CMDB group correlation (evt_mgmt.related_cis_get_all_relation_types).
Select Save.

To group alerts without a CI as Text-based or ML based groups, set sa_analytics.enable_no_ci_grouping to true. Ensure the Feature Identifier includes both the node and metric name. For details on configuring the feature identifier, see Manage pattern identifier attributes for alert grouping.
Set evt_mgmt.alert_groups_reasoning.enable_worknotes to none to prevent group reasoning work note display.

By default, a work note appears in the Activities tab when a group is created or updated, showing the grouping reason.

Related topics

Automated alert grouping

CMDB based alert grouping

Text-based alert grouping

Tag cluster alert grouping

60 lines · 3.8 KB Wrap lines

---
title: Configure scheduled job-based alert grouping
description: Set up rules and parameters to group related alerts automatically, streamlining alert management and reducing alert noise.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/it-operations-management/event-management/enable-alert-grouping.html
release: australia
product: Event Management
classification: event-management
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 2
breadcrumb: [Scheduled jobs and parameters for alert grouping, Alert grouping, Configure, Event Management, ITOM AIOps, IT Operations Management]
---

# Configure scheduled job-based alert grouping

Set up rules and parameters to group related alerts automatically, streamlining alert management and reducing alert noise.

## Before you begin

Role required: evt\_mgmt\_admin

## About this task

The scheduled job Service Analytics: Group Alerts Using RCA/Alert Aggregation helps in grouping alerts.

## Procedure

1. Navigate to **All** &gt; **Event Management** &gt; **Administration** &gt; **Alert Correlation Properties**.

2. On the Alert Correlation Properties page, enable the relevant properties.

- Enable CMDB correlation \(**sa\_analytics.agg.query\_cmdb\_correlation\_enabled**\).
- Enable Network Traffic correlation \(**sa\_analytics.agg.query\_network\_traffic\_correlation\_enabled**\).
- Enable ML based Automation correlation \(**sa\_analytics.specific\_patterns\_enabled**\).
- Enable Text based correlation \(**sa\_analytics.text\_based\_group\_enabled**\).
- Group by property, with comma-separated list of field names. Alerts can be grouped together when the specified field values match each other. The property can contain alert field names \(such as assignment\_group\), CI field names \(such as alert\_cmdb\_ci.location\), or alert additional info field names \(such as additional\_info.state\). It can also contain alert tags \(such as t\_data\_center\). Property: **sa\_analytics.agg.group\_alert\_with\_same\_group\_by\_fields**.
- Max number of relations between CIs in a topology which form a CMDB group \(**sa\_analytics.agg.query\_cmdb\_graph\_walk\_nodes**\).
- Use all CMDB relations for CMDB group correlation \(**evt\_mgmt.related\_cis\_get\_all\_relation\_types**\).
3. Select **Save**.

To group alerts without a CI as Text-based or ML based groups, set **sa\_analytics.enable\_no\_ci\_grouping** to `true`. Ensure the Feature Identifier includes both the node and metric name. For details on configuring the feature identifier, see [Manage pattern identifier attributes for alert grouping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/ptrn-attributes-alrt-aggregate.md).

4. Set **evt\_mgmt.alert\_groups\_reasoning.enable\_worknotes** to `none` to prevent group reasoning work note display.

By default, a work note appears in the **Activities** tab when a group is created or updated, showing the grouping reason.

**Related topics**

[Automated alert grouping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/c_SACorrelatedAlertGroups.md)

[CMDB based alert grouping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/cmdb-alert-groups.md)

[Text-based alert grouping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/text-based-alert-groups.md)

[Tag cluster alert grouping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/alert-clustering-tag-definitions-concept.md)