topic Re: Why are ITSI Impacted Entities are not showing up in the Episode Review? in Splunk ITSI

Why are ITSI Impacted Entities are not showing up in the Episode Review?

iamsplunker — Mon, 17 Apr 2023 20:57:57 GMT

Hi ,I've created the correlation search for problem notifications and defined/enabled the entities in the search also defined the entities in the service. The search is generating notable events. However the impacted entities are not showing up.

Please advise on the next steps what to verify/check to see this in the Episode Review.

Re: ITSI Impacted Entities are not showing up in the Episode Review

srauhala_splunk — Mon, 17 Apr 2023 13:04:34 GMT

Hi! are the field entity_title used in the notable events / episodes?

Re: Why are ITSI Impacted Entities are not showing up in the Episode Review?

iamsplunker — Wed, 19 Apr 2023 18:00:19 GMT

I added entity_title to my search. The impacted entities are now showing up.

Thanks!

Re: Why are ITSI Impacted Entities are not showing up in the Episode Review?

STancredi — Wed, 04 Oct 2023 12:13:04 GMT

So I am experiencing this same issue as well, what would be the best way to add entity_title into a search or incorporate the field into the notable event/episodes?

Re: Why are ITSI Impacted Entities are not showing up in the Episode Review?

srauhala_splunk — Wed, 04 Oct 2023 13:23:37 GMT

Hi @STancredi!

Are you using services in ITSI? in that case you should already have the entity_title and serviceid in the itsi_summary index. Just do not remove them in your correlation search.

/Seb

Re: Why are ITSI Impacted Entities are not showing up in the Episode Review?

STancredi — Wed, 04 Oct 2023 15:00:26 GMT

Correct, my environment is currently utilizing services.

I do see the entity_title and serviceid within the index, so thats a good thing at least. The only correlation search we have enabled right now only utilizes entity_title apparently (I did not set these up) as its Entity Lookup field . I also reviewed our notable event aggregation policies and noticed that the only ones enabled reference the serviceid, but not entity_title. We're currently having alerts/episodes generated by the Splunk App for Infrastructure (for normalization) and a different aggregator. Neither show the Impacted Entities. Im guessing something isnt configured properly in either of them to have that data show; OR my entities are messed up.

Re: Why are ITSI Impacted Entities are not showing up in the Episode Review?

merrelr — Thu, 04 Apr 2024 18:20:27 GMT

My Episodes didn't have any "Impacted entities" until I enabled the correlation search "Service Monitoring - Entity Degraded"

Re: Why are ITSI Impacted Entities are not showing up in the Episode Review?

proyleJDS — Mon, 05 Aug 2024 06:48:19 GMT

I was having the same trouble, even after adding the entity_title field to my correlation search. I fixed it by also adding the entity_key field.