Can we merge notable events from Splunk IT Service Intelligence and Splunk Enterprise Security?

[paulstout]

Is it possible to merge the notable events from Splunk IT Service Intelligence (ITSI) and Splunk Enterprise Security (ES)? Ideally, I'd like to create a single location where our analysts can review incidents. ITSI is not in production at this time, but it would be possible to install that on an ES search head if that would help. Any insight would be appreciate, thanks!

[smoir_splunk · Accepted solution]

This is not possible at this time.

This is largely due to the added search performance that you would incur by having both apps hitting the same indexers. In addition, the notable events are stored in separate indexes for both apps and cannot be viewed in a unified view. For performance reasons and CIM- and other supporting add-on incompatibilities that can occur, it isn't recommended to install ITSI and ES on the same search head.

Do you have one ops team that would be reviewing and responding to both IT outages and security incidents? I'd be interested to hear more about the use case for a unified view at your organization.

[paulstout]

Thank you! Yes, our platform services team is responsible for care and feeding of Splunk as well as some of the ES notable events. My question was from a desire to create a single pane of glass -- ideally filtered views for different teams -- for a better user experience, easier to manage, etc etc.

I can appreciate the difficulty in integrating these -- maybe moving the notable events to the kvstore would make this easier in future releases?

Thanks again, this answered my question.

[smoir_splunk]

Thanks for the added context, Paul!