How to find duplicates incidents

[D.Szr008688]

Hello! I would like to ask if anyone can help me find duplicate incidents based on key value pairs in Context data?

[eluis]

Hi @D.Szr008688 

Not sure what you mean by duplicates. There should be no duplicates. 

If an incident is closed and reproduces, this is not a duplicate. 

If new alerts are produced they should be part of the same incident. 

So I dont see like a duplicate by mistake, if there are these type of duplicates (for example same incident ID), please open a TAC support ticket. 

If you dont handle and close incidents the same situation and an incident can be produced again for example with the same description "but different incident ID" . We cant consider this as a duplicate

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". 

Thank you.

Luis 

[D.Szr008688]

My problem is that with the !FindSimilarIncidents automation, I don't know how to search for duplicates based on context data. The attached image shows that I want to find incidents based on the Email.From field that have the same value in the Email.From field. Can you help me put together a command for this? No matter how I try to enter the Email.From field into another argument, it doesn't work.