Subgrouping alerts within a finalized group based on topology details

Alerts can be subgrouped within a finalized group based on topology details.

Custom subgrouping is done by:

1. Looking at the finalized group that has a parent that is tagged as FINALIZED.
2. Retrieving all the children within the group.
3. Dividing the group (to create the subgrouping) based on the default criteria from the topology group.

The subgrouping process picks up the topology details from the CEACorrelationDetails and CEAAsmDetails fields, parses them, and retrieves the information from them.

By default, the process uses the groupName parameter from the data as the subgroup divider. If the event belongs to multiple group names, the groups are sorted and the first one in the list is taken as the divider.

The groupTags parameter can be used instead by setting the useGroupName to false. The same process is then followed.

The subgrouping process creates new artificial subparents that hold the divided group based on the groupName or on the groupTag parameter. Each new subparent has the number of children within the subgroup as active events, the number of topological events, the number of seasonal events, and an Investigate link to view the events.

The original (main) parent includes the number of events, seasonal and topological, and an Investigate link. This link displays only the children of the subparent (new custom, artificial events) without the grandchildren (the main active events). This link is a known limitation of the subgrouping process.

The process involves configuration in both Netcool®/Impact (see Subgrouping project) and the ObjectServer (see Enabling subgrouping within the Event Viewer).