Splunk Enterprise

itsi episodes count updating though resolved

iamvinaykumar
Engager

Hi Community ,

We have integrated our itsi cluster to servicenow and tickets are creating fine.  but recently observed a strange behavior from splunk itsi  that . episodes generated in episode review will create servicenow incident . once issue resolves episode will get resolved .

 

But when the same issue happens with same node  , resolved episode count gets increased , instead of creating new notable event and a new episode. itsi logs  doesnot provide much details about this , please help check why .

 

Best regards

Vinay

vi323056@wipro.com

Labels (2)
0 Karma

iamvinaykumar
Engager

Thanks !! found a way to resolve it 🙂

0 Karma

seths
New Member

1. Try moving the event to closed state instead of the Resolved.
2. You can even check your actions rules for the breaking of episode it should have the states mentioned to break the episode.

3. Also check if the CorrelationID it should change for new Episodes.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...