ExpertExpert
ExpertO = Open
S = Solved/Closed
What Mike is suggesting is that it shouldn't have opened two tickets, but rather the escalation should have updated the existing ticket. But that sounds like that's the way you want it. If that's the case, is it because you modified the escalation payload to make the integration open a new ticket?
ProfessorThe Log is showing that it sent an Active call when it should have been an Escalated call. The 2nd Active call would caused a new ticket and updated the externalticketid. What does your integration settings look like? You have different URLS enabled and escalated/de-escalated option enabled?
ExpertActually, I prefer that it opens a second ticket. If I change the Alert Rules so that Errors and Criticals both use the same rule, then it will update the existing ticket. However, because we put data in the ticket subject line like Error, 9 Gigs free, etc, If the existing ticket would get updated when it changed to a Critical, we wouldn't see that because the subject line wouldn't get updated. So I'd think the issue was still an Error when in reality it was now much worse.
Based on that, I prefer that it does create a second ticket so it says Critical in the subject. I just then want it to automatically close the Error ticket since it was replaced by the Critical ticket.
After waiting a few weeks for Support, the confirmed this is just how it works and nothing can be done. As usual, I was referred to the "Feature Request" link so I filled it out so my idea can go into the same black hole all the other ideas went into. ;)
ProfessorIf I recall correctly, LM will send an updated subject/message when the level increases (but not decrease) which should help with that issue if that is only reason for multiple tickets. Although I'm still not sure why LM is not sending you Update calls when the level increases. Did support explain that issue?