Situation Merge Behavior

Moogsoft AIOps uses a configuration called the sig_similarity_limit to automatically merge similar Situations. When two Situations reach this similarity limit, Moogsoft AIOps merges them.

The default similarity limit for clustering algorithms is '0.7' so Situations sharing 70% of the same alerts are merged.

Merge Groups

You can use merge_groups in moog_farmd.conf to control how Moogsoft AIOps merges Situations created by different clustering algorithms.

Any Sigaliser/moolet not defined in a new merge group belongs to the default group. By default, Moogsoft AIOps merges Situations when they meet the following criteria:

alert_threshold      : 2,
sig_similarity_limit : 0.7

To override the default behavior, you can create custom merge groups.

Create a Merge Group

You can create merge groups by following these steps:

Edit moog_farmd.conf.
Define new merge groups in the merge_groups section. For example:
```
# {
#        name: "Merge Group 1",
#        moolets: ["Cookbook", "Tempus"],
#        alert_threshold      : 3,
#        sig_similarity_limit : 0.75
# }
```
This merge group would only merge Situations created by the Cookbook and Tempus Sigalisers which shared 75% of the same alerts.

Each new merge group must be given a name and can be defined using the following values:

moolets

One or more Sigalisers/moolets which will be included in the merge group. Only Situations created by this Sigaliser or Sigalisers will be considered for merging with each other.

Type: String

Default: n/a

alert_threshold

The minimum number of alerts that must be present in a cluster before it can become a Situation in the merge group.

Type: Integer

Default: 2

sig_similarity_limit

The measure of the similarity between two Situations before they are merged together. This value is the ratio of shared alerts between two Situations to total unique alerts in both Situations. For example, if two Situations share 50% of the same alerts, the value would be 0.5.

Type: Integer

Default: 0.7

If you create a custom merge group for one or more Sigalisers, only Situations produced by the Sigalisers in the merge group will be considered for merging among themselves. Situations from Sigalisers outside of the defined merge group cannot be merged with any Situations in that group.

Field Behavior

When Moogsoft AIOps merges two or more Situations, it updates the fields of the Situations as follows:

Field	Old Situations	New Situation
Category	Superseded.	Created.
Created At	No change.	Time of merge.
Description	No change.	Merge of Situations [X, Y, Z] where X, Y, and Z represent the Situation IDs of the superseded Situations.
First Event Time	No change.	The First Event Time for the combined Situations.
ID	No change.	The next sequential Situation ID.
Last Change	No change.	The time that the merge took place.
Last Event Time	No change.	The value of the Situation in first position in the merge list.
Owned By	No change.	Default (none).
Participants	No change.	Default (none).
Process Impacted	No change.	Combined values.
Queue	No change.	The queue of the Situation in first position in the merge list.
Rating	No change.	Default (none).
Scope	No change.	Combined values.
Scope Trend	No change.	Combined values.
Services Impacted	No change.	Combined values.
Sev Trend	No change.	Combined values.
Severity	No change.	The highest severity of the merged Situations.
Status	Dormant.	Opened.
Story	Adopts ID of new Situation.	The Story ID is the same as the Situation ID of the new Situation.
Teams	No change.	All Teams monitoring the merged Situations.
Total Alerts	No change.	The sum of the Alerts of all merged Situations.
User Comments	No change.	Default (none).

In this section: