https://community.splunk.com/t5/Splunk-ITSI/Splunk-IT-Service-Intelligence-Are-notable-event-aggregation/m-p/257947#M189 <P>Hello, </P> <P>ITSI Notable Event Aggregation Polices are stored in the KVStore. Collection related stanza is [itsi_notable_event_aggregation_policy] in<BR /> SPLUNK_HOME/etc/apps/SA-ITOA/default/collections.conf.</P> Tue, 29 Sep 2020 12:31:32 GMT mglauser_splunk 2020-09-29T12:31:32Z https://community.splunk.com/t5/Splunk-ITSI/Splunk-IT-Service-Intelligence-Are-notable-event-aggregation/m-p/257946#M188 <P>Are Splunk IT Service Intelligence (ITSI) notable event aggregation policies stored in a .conf file? If so, where is it? the only thing that I see documented is how to view via the GUI.</P> Mon, 23 Jan 2017 19:55:01 GMT https://community.splunk.com/t5/Splunk-ITSI/Splunk-IT-Service-Intelligence-Are-notable-event-aggregation/m-p/257946#M188 earlhelms 2017-01-23T19:55:01Z https://community.splunk.com/t5/Splunk-ITSI/Splunk-IT-Service-Intelligence-Are-notable-event-aggregation/m-p/257947#M189 <P>Hello, </P> <P>ITSI Notable Event Aggregation Polices are stored in the KVStore. Collection related stanza is [itsi_notable_event_aggregation_policy] in<BR /> SPLUNK_HOME/etc/apps/SA-ITOA/default/collections.conf.</P> Tue, 29 Sep 2020 12:31:32 GMT https://community.splunk.com/t5/Splunk-ITSI/Splunk-IT-Service-Intelligence-Are-notable-event-aggregation/m-p/257947#M189 mglauser_splunk 2020-09-29T12:31:32Z