Identifying clusters of incoming incidents

Each tile on the dashboard represents a cluster. The ranking of tiles can go up or down after each refresh. The clusters that have a major incident or a possible major incident are marked in the dashboard as shown in the following image:

Before you begin

Make sure that the BMC Helix ITSM administrator has provided the required permissions to work with incidents.

To search by cluster name

To search for a cluster, start typing the cluster name in the search box on the Real-time incident correlation dashboard.

The application displays clusters with name that match or partially match the search text. If you press the Enter key or click the search button after an initial search, this action does not trigger a new search unless the search text is updated.

To view and manage incident relationships

Drill down into a cluster to view the duplicate and original incidents. You can relate multiple incidents as duplicates of a single original incident.

ITSM Insights retrieves the relationship between incidents from BMC Helix ITSM: Smart IT. When you add or remove a relationship in BMC Helix ITSM: Smart IT, the same is updated in ITSM Insights as well.

1. Click the cluster name. 
   The incidents in the cluster are displayed in a tabular format.
   By default, the Hide Duplicates checkbox is selected and the duplicate incidents are not displayed.  
   
   If you want to view the duplicate incidents in a cluster, clear the Hide duplicates check box.
   

1. In the Relationships column, depending on whether the incident is an original or a duplicate, click Show duplicates or Show original to see the related incidents.  
   • Show duplicate: Displays the duplicate incidents in a separate window. From here, you can also change the original incident or remove the original relationship. 

1. • Show original: Launches Smart IT to display the original incident.

To change original and remove original relationships

Click Show duplicates to see the related incidents. 

• To change the original incident, select one or more incidents and click Change original. Select a new original incident and click Continue to save the changes.
  

  Click Save in the resulting dialog box to change the original incident.

  

• To remove the association with an original incident, select one or more incidents, and click Remove relationship. In the resulting dialog box, click Save.

  

To relate incidents as duplicates of an original incident

1. Select the incidents from the table. 
   You can identify original incidents in the cluster by their icons:

   Icon	Incident description
   	Represents the first incident in the cluster if the incident is not related to any duplicates. It is usually suggested by the algorithm.
   	Represents an incident that is associated as an original in ITSM Insights or BMC Helix ITSM.

2. Click Manage Original/Duplicate.
   The Relate selected incidents to Original window is displayed.
   
   To view a list of incidents within the cluster that can be marked as an original, click the Incidents associated with the cluster tab.
   To search for an incident available outside the cluster that can be marked as an original, click the Search for existing incident tab.

   Important

   You cannot mark duplicate incidents as the original of each other.

3. Perform one of the following steps:

   • To relate an incident available in the cluster
   • To search and relate an incident available outside the cluster

   A list of incidents that can be associated as originals is displayed.
   The first incident of the cluster is indicated as the recommended original. If an incident is already associated as an original in BMC Helix ITSM, it is indicated as an original, as mentioned in the table.

   An original incident that is in Closed or Resolved status is not displayed.

   Perform these steps to mark an incident within the cluster as an original:

   1. In the Relate selected incidents to Original window, click the Incidents associated with the cluster tab.
   2. Select an original incident and click Continue.
      
      
      
   3. Click Yes in the Mark as duplicate dialog box.
      

   Perform these steps to search and mark an incident that is available outside the cluster as an original:

   1. In the Relate selected incidents to Original window, click the Search for existing incident tab.
   2. Specify some search criteria, such as a company name, summary, incident ID, or associated keywords. To search for all incident records, enter the % wildcard character.
      Based on your search criteria, the top 50 matching incidents are displayed.
   3. Select the incident and click Continue.
      

   1. Click Yes in the Mark as duplicate dialog box.
      

To export a list of incidents from a cluster as a CSV file

You can select and export the incidents within a cluster to a .csv file and use this file for offline analysis. Also, you can share the file with other users for a second opinion about your analysis. 

1. Click the cluster name that you want to export.
   The drill-down view is displayed.
2. (Optional) Apply the necessary filters to view the incidents that you want to export in the table.
3. Select the incidents that you want to export, and click Export.
4. In Export Selection, click CSV.
   
   
5. (Optional) To download all incidents available in the table, click CSV in Export entire document.