Editing Incidents

Merging Incidents

Merging related incidents into one incident streamlines the notification and resolution process when an incident is triggered. Merging incidents also enables you to consolidate the alert information into a single incident, helping responders identify the root cause and impact. Before merging incidents, make sure that you have enabled alerts and incidents for your service.

How to merge incidents

If there are two or more triggered incidents on the incident dashboard, you can merge them into a single incident. When you merge them, they will appear as a single incident with multiple alerts.

  1. Use the checkboxes to select the incidents
  2. Next, select Merge Incidents.
  3. In the popup, you can choose which incident you would like all of the alerts to be grouped under. When merging, you also have the ability to update the incident summary to more accurately reflect the problem.
  4. The incident dashboard will show a single incident. When you click to open the Incident and view its details, the alerts that you merged will be listed as the incident details.

You can also merge incident on the Incident details page by clicking Merge Incidents on the right side of the page. Then enter the incident number to merge into.

To view more granular details about what was sent you can also navigate to Show or Hide Details.

What happens when incidents are merged

When merging multiple incidents together, alerts will be consolidated into the selected incident. The other selected incidents will be resolved, with the reason for the resolution listed as "merged". These incidents will reference the target incident that you selected in the merge dialog.

The deduplication key, called the alert_key, will not be changed, but it will move so that it is under a single incident with other deduplication keys.

If you are using a bidirectional integration such as the Slack integration, the merged incidents will display as resolved and reference the new target incident that contains all of the alerts.

When you merge the incidents, acknowledgers, assignees and responders from the source incidents are not merged. Instead, the target incident’s assigner, responder, and acknowledgers are preserved and they become the user(s) assigned to all alerts under that incident. These users may be viewed under the Response tab on the incident's page.

Moving alerts to another incident

If an alert is incorrectly merged, open up the Alert details page and select Move to Another Incident in the upper right hand corner. A dialog box will prompt you to move the alert to its own new Incident, or you can optionally move the alert to an existing incident in PagerDuty:

Merged incidents and webhooks

If you are using webhooks, merging alerts into a single incident will send a resolve action through the webhooks for the source incidents with a resolve_reason of “merged.”

Webhooks will continue to update the target incident, but all past incidents that were merged into the target incident will be updated as resolved.

Likewise webhook updates will only continue to be sent for the service for that target incident; all past resolved incidents will remain resolved for other services. For example, if an incident from service A is merged into an incident for service B, only webhooks on service B will continue to be sent.

For incidents that were resolved when merged into the target incidents, the resolve webhook will trigger, if there are any that are configured. These incidents will contain reference to the new target incident ID: in the API response, the field will be merged_into_incident.

Snooze an Incident

Snooze allows users to keep an incident in an "acknowledged" state for the following intervals of time: 1 hour, 4 hours, 8 hours, 24 hours or Other. As an incident responder, this means I can snooze an incident while I troubleshoot the problem — or go back to bed and avoid being woken up again by an issue that can wait until later!

How do I snooze an incident?

You're only able to snooze acknowledged incidents. You can acknowledge an incident from either the web or mobile application. The following example outlines snoozing an incident in the web UI:

  1. Acknowledge the incident.
  2. Select Snooze and the length of time the incident should be snoozed.

The incident log will capture all snooze actions taken on an incident. If Other is selected, you will have the option to select a custom snooze time, snooze until a time tomorrow, or base your snooze on support hours for that service.

Incidents that are not resolved within the specified snooze timeframe will return to a triggered state and started notifying assigned users again, following their notification rules. In the below example you can see that when the snooze for an incident timed out, and when the incident returned to a triggered state and re-notified the user.

Q: What happens if I reassign a snoozed incident?

A: Reassigning a "snoozed" incident will cancel the snooze timer. The timeout setting will reset to the default timeout setting which is configured within the service from which the incident originated.

Q: What happens if another user acknowledges the incident after I snooze the incident?

A: If another user acknowledges the incident we will un-snooze the incident, and the un-acknowledgement timer will start again.

Add a Note to an Incident

You may want to add a note to an incident for other users to refer to. You can add this to an open or resolved incident.

In Web UI

  1. On the Incidents page, click on the name of an incident to open up the incident details.
  2. Open the Response tab. Enter your note and click Add Note.

In Mobile App

  1. Open the mobile app. Open the menu and tap either Open Incidents or Resolved Incidents
  2. Tap on the incident you would like to add a note to to open its details.
  3. On iOS, tap the More button at the bottom of the screen. On Android, tap the menu icon in the top right corner.
  1. Tap Add Note.
    5.Enter your note and tap Done on iOS orAdd on Android.

Editing Incidents