SN System Properties Reference
Property reference

sa_analytics.correlation_case_sensitive

Sets whether alert correlation treats uppercase and lowercase letters as different. With the default value of true, differently cased filter text does not match; setting it to false makes matching ignore letter case.

Default
true
Type
boolean
Application
Not stated

Key questions about this property

The answers below summarize the purpose, scope, default effect, and review scenarios for this property.

What does it do? Determines whether tag-based alert correlation and filter parameters distinguish uppercase from lowercase letters; true is the default.
What area does it affect? Alert correlation and clustering
What does the default mean? The default value is "true", which means this behavior is enabled by default.
When should you review it? Review when alert filters or tag-based matching should treat differently cased text as equivalent.

Property record

No out of the box record exists. ServiceNow scripts read this property and use the default value shown until you create it.

Property name sa_analytics.correlation_case_sensitive
Type boolean
Application Not stated
Default value true
Description Not stated

Sources

Official references and nearby text excerpts where this property appears.

Brazil docs View supporting context
Context preview Snippet 1
... together in an alert group. Alerts are grouped only if they have corresponding alert clustering tags. • Filter parameters are case sensitive by default. To disable case sensitivity, set the sa_analytics.correlation_case_sensitive parameter to false. • You can also configure alert fields to be excluded from the search, using the sn_em_tbac.tag_excluded_alert_fields property. By default, the following are excluded by this property: ◦type ...

Used in

Out of the box artefacts that read this property. Append the path to your instance URL to open the record and see how the value is used.

Script include: EMTagSimAlertGroupHandler Alert correlation reads this setting to decide whether text comparisons distinguish uppercase and lowercase letters. Set it to false to ignore letter case; otherwise comparisons are case-sensitive, and the default is true. /sys_script_include.do?sys_id=43fa39273b110e10a203118aa4e45ab4
Script include: EvtMgmtTagBasedComparators This setting determines whether correlation matching distinguishes uppercase and lowercase letters. If it is not set, the code defaults it to true, meaning case is significant. /sys_script_include.do?sys_id=08d44353532c70107c03ddeeff7b120a
Script include: EvtMgmtTagBasedDefinitionToACR The setting is read when the generated alert-correlation script runs and controls whether tag-based alert matching treats case differences as significant: true makes matching case-sensitive. If unset, it defaults to true; the value is also included in correlation debug information. /sys_script_include.do?sys_id=21c4a01db76830107c038229ce11a910
Alert Correlation Rule: [Tag Based] Group alerts from the same namespace The rule reads this setting to control whether alert filtering distinguishes uppercase and lowercase text: true makes matching case-sensitive, while false makes it case-insensitive. If the setting is unset, the rule defaults to true. /em_alert_correlation_rule.do?sys_id=e9fa38ac6761c210a26cf94ad8f922c3
Alert Correlation Rule: [Tag Based] Group alerts from the same subnet This rule reads the property to decide whether alert-filter comparisons distinguish uppercase and lowercase; true makes them case-sensitive, while false makes them case-insensitive. If unset, it defaults to true. /em_alert_correlation_rule.do?sys_id=ac09fd7867e9c210a26cf94ad8f92244
Alert Correlation Rule: [Tag Based] Group alerts with the same Application The alert correlation rule reads this setting to control whether Application values must match capitalization when grouping alerts: true requires matching capitalization, while false treats capitalization as irrelevant. If unset, it defaults to true. /em_alert_correlation_rule.do?sys_id=c1e73d16074b7510d4728c14dfd3000c
Alert Correlation Rule: [Tag Based] Group alerts with the same Application and Environment /em_alert_correlation_rule.do?sys_id=0a48fd56074b7510d4728c14dfd30021
Alert Correlation Rule: [Tag Based] Group alerts with the same Assignment group and Class /em_alert_correlation_rule.do?sys_id=9367e625078f3110d4728c14dfd300b5

More in sa_analytics

Other properties in the same namespace.

sa_analytics.agg.query_network_traffic_correlation_enabled This property activates the correlation of alerts based on network traffic, allowing for more accurate… sa_analytics.aggregation.include_service This property configures the inclusion of all CIs in alert aggregation, impacting how alerts are processed… sa_analytics.aggregation_enabled This property enables the aggregation of alerts based on predefined criteria, facilitating better… sa_analytics.alert.severity_threshold This property determines the severity threshold above which alerts are included in alert aggregations and… sa_analytics.disable_prc This property, when set to true, stops the system from performing Probable Root Cause Analysis on change… sa_analytics.enable_no_ci_grouping This property enables the grouping of alerts that lack associated CIs, facilitating better organization and… sa_analytics.enable_process_mapping_calculation This property enables or disables the calculation of process mapping, impacting how alerts are correlated… sa_analytics.filtered_alerts_enabled Enables filtered alerts in Service Analytics; when disabled, users are warned that their changes will not be…

All 62 properties in sa_analytics →