Correlation Event key

[ritail (Guido Dolci)]

I’m trying to correlate two events, i.e. access point down, access point up (for which I individually set a key which is successfully shown).

However, the same key I use for the individual events, it is set in the correlation event, which should send an alert if an access point goes down and does not come up within 5 minutes. And in this case the key never shows up (in the alert email, or in the alert dashboard) , even if triggers the action (which makes me think it’s not correlating according to the key).

Any ideas?

[gsmith]

Hello && welcome @ritail

To help you further can you show us by an example of what you did and/or configurations?

[ritail (Guido Dolci)]

Hi there! That’s the correlation event config:

Which triggers some alerts, but they have no key (i.e. the mac address of the access point).

Thanks

[gsmith]

Hello @ritail

Correct me if I’m wrong, your looking for the Key in the Email notification? Or some where else you want to see the key?

[ritail (Guido Dolci)]

Either in the email, or in the Alerts & Events dashboard

Now key value is always “none”

[gsmith]

Hello.

Ok I see now.

Event Definition navigate to Fields.

Results

Hope that helps

[ritail (Guido Dolci)]

To be honest, that’s what I already have:

It works with my my Filter & Aggregation events, it does not with my correlation event.

[gsmith]

Ok, give me few I’ll check this out in my lab.