Removing an event from a related events group

Edit online

You can remove an event from a related events group.

About this task

When you believe that an event is no longer related to other events in the related events group, you can remove the event from that events group. When you remove an event from a related events group, the event is hidden from the UI and the correlation process but the event is not deleted from the system. Complete the following steps to remove an event from a related events group.

Procedure

  1. View event groups and events in the View Related Events portlet, see Viewing related events and Viewing related events by group.
  2. Within the View Related Events portlet, in the Group table select an event group or in the Event table select an event, and right-click. A menu is displayed.
  3. From the menu, select Show Details and a Related Event Details portlet opens.
  4. Within the Related Event Details portlet, in either the Events tab on the events table or in the Correlation Rule tab, right-click on an event. A menu is displayed.
  5. From the menu, select Remove Event.
    Note: You cannot remove the pivot event or the parent synthetic event. For more details on these events, see About the pivot event and the parent event.
  6. A confirmation message is displayed, select Yes or No.

Results

The event is removed from the group and no longer appears in the event list in either the Events tab or the Correlation Rule tab.