Two SQL primitives for when alert clustering gets it wrong

Originally published at theculprit.ai/blog/sql-primitives-for-incident-split-merge . Every alert-correlation system gets things wrong. The interesting question is what the on-call engineer can do about it at 2 a.m. The bad answer is: nothing. The system grouped seven events into one incident; six of them are the database connection-pool storm and the seventh is a totally unrelated TLS-handshake failure that happens to share some token overlap with the rest. The on-call sees one incident in the d