Updating existing ServiceNow tickets when a "duplicate" alarm is received

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

What conditions need to be satisfied for an alarm to be recognised as a "duplicate" and what are the time conditions for retrieving existing ServiceNow incidents (i.e. how far back in time does the probe look for unresolved Incidents)?

I have set the comments_and_work_notes ServiceDesk Field to the value of the alarm message. 

What I want to do is to configure the probe so that Alarm_A occurs and Incident_A is raised via the sdgtw probe in the ServiceNow instance.
Some time later another instance of Alarm_A is raised.  What I want to happen is:
i) for Incident_A to be updated with information from the second instance of Alarm_A if Incident_A is not in a Resolved or Closed state.
ii) Incident_B to be raised if Incident_A is Resolved or Closed
iii) Incident_B to be raised if Incident_A is older than x hours

My question is more to do with how the backend ServiceNow instance behaves when duplicate/similar alarms are raised by UIM and how that is configured from the sdgtw probe side.

Resolution

Effectively it works like this..... 

•  1) An alarm arrives, gets assigned to a user (administrator) and gets picked up by the sdgtw probe. 
•  2) A ticket gets created in ServiceNow. 
•  3) A duplicate alarm arrives some minutes later. The probe checks to see if the custom_4 field contains a reference to an Incident. The alarm count is increased. 
•  4a) If custom_4 contains a reference to an Incident and the alarm message has changed then the work notes in the ticket are updated (subject to the correct probe config being set) 
•  4b) If custom_4 contains a reference to an Incident and the alarm message has NOT changed then nothing happens. 
•  5) If the original alarm is closed (acknowledged) and a new instance of the alarm is received a new ServiceNow incident will be created.