Events ignored from episode after Bidirectional Ticketing Event

[jtv1703]

I have a NEAP that is configured to create a ServiceNow ticket after 4 events have been added to the episode. Every time, the NEAP will see 4 ("Service Monitoring - Entity Degraded" source) events from the itsi_tracked_alerts index, add them to the episode, then create the ticket. Then, a few minutes later, I see an event from the Bidirectional Ticketing source show up in the itsi_tracked_alerts index under the same groupid. Then, every subsequent "Service Monitoring - Entity Degraded" event that should be getting added to the episode gets ignored.

I suspect it has to do something with how my events are being filtered and split-by. But what's weird is that the episode shows up perfectly fine in the preview pane of the NEAP. 

[arthurdavid]

Hi,

I am also facing a similar issue in ITSI after enabling Bidirectional Ticketing. Once the ServiceNow ticket is created and the bidirectional event is generated, subsequent events with the same criteria are getting ignored and are no longer being added to the episode.

It looks like the episode grouping behavior changes after the bidirectional event is introduced, possibly due to how the Rules Engine or aggregation policy evaluates incoming events. In my case, only the bidirectional ticketing events continue to be processed, while normal “Service Monitoring - Entity Degraded” events are being filtered out.

Has anyone confirmed whether this is expected behavior or if there is a recommended configuration to prevent bidirectional events from affecting episode event ingestion?

Any guidance on adjusting split-by fields or filtering logic in NEAP would be appreciated.

[jtv1703]

Hello,

I eventually figured out why this was happening. The events that were being generated by the bidirectional ticketing correlation search were being populated with the "group_id" field. The rules engine would then add this event to the episode. My guess is that when the bidirectional event is "forced" into the episode because of the "group_id" field, the rules no longer work as expected.

The bidirectional ticketing correlation search is based on a macro, so I am not sure if that is expected behavior. I can't imagine that it is expected behavior, as it completely messes up event ingestion. Who knows.

Anyway, what I did to "fix" it was in the bidirectional ticketing correlation search, add the following line:

| fields - group_id

Once this line removes the group_id from the bidirectional event, the rules engine no longer adds bidirectional events to the episode, and normal entity degraded events continue to flow into the episode.

Hopefully this helps, as it took me forever to figure this out.