Supervised Correlations

Supervised Correlations is a standard configuration interface for adding, editing, and removing correlation policies. The Supervised Event Correlator microservice uses these policies to correlate multiple symptom events with a root cause event. A root cause event may already exist in the event list or it can be a Meta Event, created when the symptoms are detected.

For information about interacting with the grid and form, see Standard Configuration Interface in Unified Assurance Concepts.

This user interface calls REST methods from the api/event/supervisedCorrelations endpoints. See REST API for Unified Assurance Core for details.

To open this interface, from the main navigation menu, select Configuration, then Events, and then Supervised Correlations.

Form Fields

• Name: The name of the correlation policy.

• Match Fields: The fields from the Event database that are available in the Root Cause and Symptoms sections. Geometry fields with linestring or point types are not available for selection. Those sections are updated dynamically as you add or remove fields here. Existing values for fields that remain selected are retained when you add another field.

• Root Cause: Use this area to define the values of the root cause event to correlate with symptom events. It contains the following fields:

  • List of fields: An operator and text field appear for each database field added in Match Fields. You can enter only one value for each field. The operator defines how the Supervised Event Correlator compares the root cause field value. The operator list uses the same labels and icons as the event grid filter bar. Numeric and date fields use comparison operators, string fields use equality, like, and regular expression operators, and fields without a known type show all operators.

    For example, assume you added Location and Node in Match Fields, then set the value of Location to Houston and Node to router1.example.com. To find the root cause in this correlation, the Supervised Event Correlator looks for events where Location is Houston and Node is router1.example.com.

  • Meta Event: The meta event to create if a new root cause event should be created when the symptoms exist.

  Note:

  You can either select a meta event, or enter values in the list of fields; you cannot do both.

• Symptoms: Use this area to define the symptom events to correlate with the root cause. It contains the following fields:

  • List of fields: An operator and text field appear for each database field added in Match Fields. You can enter multiple distinct values for each field, with each value on a separate line. The operator defines how the Supervised Event Correlator compares the symptom field values. The operator list uses the same labels and icons as the event grid filter bar. Numeric and date fields use comparison operators, string fields use equality, like, and regular expression operators, and fields without a known type show all operators.

    For example, assume you added Location and Node in Match Fields, then set the value of Location to Chicago and Dallas (on separate lines), and Node to server1.example.com and server1.example.com (on separate lines). To identify symptoms in this correlation, the Supervised Event Correlator looks for events where Location is Chicago or Dallas, and Node is server1.example.com or server2.example.com.

  Note:

  You can create a correlation policy where some of the root cause and symptom and values overlap. However, all of the values cannot overlap. For example, assume you added Location and Node in Match Fields. If you set Location to Houston in both Root Cause and Symptoms, the correlation policy is valid as long as the values for Node are different. Even if you specified multiple values for Node in Symptoms, for the policy to be valid, all of them must be different from the Node value in Root Cause.

• Cluster Conditions: Use this area to define clusters of similar symptom events. It contains the following fields:

  • Group By: The field to group events by. You can select any Event field, except geometry fields with linestring or point types, even one other than those selected in Match Fields.

  • Minimum Members: The number of events that must exist to create a cluster. This number does not include the synthetic Meta Event.

  • Time Window (Secs): The time window during which the minimum members must occur.

• Status: Whether the correlation policy is enabled or disabled.

---

Title and Copyright Information

User’s Guide

G49437-03

Copyright © 2026, Oracle and/or its affiliates.