Alerts on multiple hosts, trigger only 1 alert

[lbm]

Hi

I have an check which are on multiple hosts. This check is often triggered at the same time, which is OK. But I dont want to be notified like 25 times minutes, but only once even though this is triggered on multiple hosts.
Is this possible ?

[cyber]

Event correlation. Create correlation rule that discards new one, if there is already existing event. You probably need to add a tag to an event, so you can correlate based on it.

[cyber]

Event correlation. Create correlation rule that discards new one, if there is already existing event. You probably need to add a tag to an event, so you can correlate based on it.

[lbm]

Thanks. I got it working, some sort at least.

1. Added an tag to the trigger expression
2. Added an correlation with "old tag name equals" the tag from 1, with operations Close new event.

So instead of 50 open triggers, or so, it only triggers 3 times. I asume its because it goes so fast, that the trigger tag is actually not set upon the first trigger, when the next ones runs ? Is there any way to mitigate this ?

-- edit --
Ok, maybe this is an non-issue, because I've changed items/triggers, to force an event doing testing.

[cyber]

There must be something else that left you with 3 events... My experience says, that those things are done in specific order and you cannot really have a situation, where "tag is not yet set" ...