Video Screencast Help
Search Video Help Close Back
to help
New in the Rewards Catalog: Vouchers for "Symantec Technical Specialist" and "Symantec Certified Specialist" exams.

Set Parent/Child programatically

Updated: 05 Aug 2010 | 2 comments
Seamless's picture
0 0 Votes
Login to vote

I can see how in the GUI to link one incident to another. But if two incidents come in from an alerting system what method can I use to link them? For example, if I get two alerts from the same server, I should be able to match them up and create one incident with a parent/child relationship. How can I do that?
Thanks,

discussion Filed Under:

Comments

heathkb's picture
02
Feb
2010
0 Votes 0
Login to vote

I will second that

I have been asked about adding in this functionality as well, but I have not come up with any solutions. 
The other suggestion was to link alert incidents based on time recieved, ie. anything after an hour goes into a new incident.

Any ideas to impliment this out there?

gpglang's picture
04
Feb
2010
0 Votes 0
Login to vote

In theory..

.. my first guess without testing it (sorry for that)

  • Created on "Master" ticket representing its goal (i.e. Server X Status messages)
  • Create an incident rule to
  1. capture the email using its unique specifics
  2. set workitem_link_parent_number to the "Master" workitem_number
  3. set workitem_link_type_lookup_id to the appropriate link type you need (lookup in Admin>Lookup.link type) is another issue as that field is not writable.  Have no solution for that right now.  The deafult will be used by HD, which is "1" I guess.
  4. set any other item to whatever value you think you need (Category, Queue, etc)

Another approach:
When you can influence the msg you server sends, you could add the "Master" ticket number as a default so HD will see the email ass an add-on to and existing Incident (look in admin>email-inboxes).  But then the email is added to the [Comment] instead of creating a Ticket for ecery message.

I would advice you to create a seperate Queue for these tickets so they do not influence you day2day job and reporting.

If you gonna try this, let us know your result!
If you have a working solution in a different way, also let us know!

I will reward the effort

Guido

Guido Langendorff
Arrow ECS Netherlands
Netherlands

Select "Mark as Solution" when it has resolved your problem.
Give a "Thumps up" when you like the comment or "Thumps down" when n