Splunk On-Call Alert Aggregation

Applicability

Splunk On-Call

Description

Alert aggregation happens when multiple alerts have the same entity_id field value. This can happen either by a monitoring tool sending the same value, or the Alert Rules Engine changing it based on a matching condition. If someone wants to mute noisy alerting without ignoring the alerts, or has multiple tools that send alerts related to the same incident, this might be the solution for them. Alternatively, alerts might be grouped under an active incident when they're not expected to.

Investigation

The first thing to look at if someone is wondering why an incident wasn't created, or didn't alert, is if that alert aggregated under another incident. In the Timeline, find the corresponding alert, and click into its associated incident. In the Incident Timeline, look if there are multiple alerts - if there are, check the entity_id for each one to note they are the same. If the alert in question should not be grouped there, the cause of the aggregation needs to be investigated and changed.

Resolution

If, for the alert in question, there is another field, vo_orig.entity_id, this indicates the alert had its entity_id field changed by the Alert Rules Engine. If there is no such field, the value is likely being passed from the monitoring tool it originates from.

Revision History

Revision	Publish Date	Comments
1.0	30-Sep-2026	Initial Release