Configure Auto-Correlation

Auto correlation groups anomalies and events across the cluster using dimensional or topology-based logic. It reduces notification noise by grouping repeated events together and aids root-cause analysis by building a single timeline of related events.

Create a Correlation Namespace

A correlation namespace defines the logic used to group anomalies or trends. To create one:

1. In the upper-right corner, click and select Settings.

2. Navigate to the System Configuration tab.

3. Next to Enable Auto-Correlation, click +.

4. Configure the new namespace:

   • Auto-Correlation Namespace: the name of the namespace. An auto-generated prefix is added based on your tenant and user.

   • Correlation Method: select Dimensions to group events by shared metadata (for example, matching Rack or jobId values), or Topology to group events by network fabric relationships. The default is Topology.

   • View Type: select Anomalies Page or Trends Page to list that page's views in View Name.

   • View Name: select the views to include in this namespace. A view can belong to only one namespace, so views that are already in another namespace aren't listed. If you use Dimensions, select the settings icon next to each selected view to choose the dimensions to correlate on for that view.

   Adding a view to a namespace turns on Auto-Correlation for that view, and removing the namespace turns it off. To change or remove a namespace later, use the edit (pencil) or remove (X) icon next to it.

Set Up a Correlation Endpoint

Next, set up the correlation endpoint to receive notifications:

1. From Settings, navigate to the Notifications tab.

2. Under Actions, click Add new endpoint.

3. Use the following configuration settings for the endpoint:

   1. Endpoint name: correlation-endpoint

   2. Plugin Type: syslog

   3. Transport: udp

   4. Servers: 127.0.0.1:59000

   5. Facility: select Inherit from event's facility

   6. Severity: select Inherit from event's notificationSeverity

   7. Application: select Inherit from event's application

      

Configure Views for Correlation

After you have configured a namespace and endpoint, enable auto correlation on each Trends and Anomaly view you selected in the namespace:

1. Navigate to a view.

2. Click the settings icon: in Trends views this is in the View Name section; in Anomaly views it is to the right of the View Selection dropdown.

3. Confirm Auto-Correlation is On to verify that this view was included in the namespace.

4. Set Notifications to Enabled and click the settings icon next to the dropdown.

5. Select correlation-endpoint from the Select Notification Endpoints list. Use dedicated auto correlation views that notify only to the correlation endpoint.

   

6. Confirm that no deduplication dimensions are selected.

7. Click OK.

8. Repeat for all views included in the namespace.

Last updated: October 30, 2026