Splunk IT Service Intelligence

How to create a search that returns the episodeid for all episodes for a given emid and timeframe?


Need a search that returns the episodeid for all episodes for a given emid and timeframe .. this is available from the 'Share Episode' dropdown for episodes displayed in the Episode Review page, I need a background search that would return this info.  

Labels (1)
0 Karma



To create a search that returns the episode ID for all episodes within a specific timeframe and associated with a particular EMID, you will need to perform the following steps:

  1. Access the database or source of data where the episode and EMID information is stored.

  2. Use a query language or programming language that can interface with the database or data source.

  3. Write a query that filters the episodes based on the given EMID and timeframe. For example, you can use SQL to create a SELECT statement that filters by the EMID and a BETWEEN clause to specify the timeframe.

  4. Execute the query and retrieve the episode IDs for the filtered episodes.

  5. Return the episode IDs to the user or store them in a data structure for further processing.

Overall, the specific implementation details of this search will depend on the specific data source and technologies you are using.

I hope this will help you.

0 Karma

Splunk Employee
Splunk Employee


The episode id is (itsi_group_id) available for all episodes in the itsi_grouped_alerts index and from the _key in itsi_notable_group_system_lookup.  The emid is the saved "Episode Review" id. The Episode Review can have some predefined episode filters and UI settings. 

There is no relation between an episode and an "Episode Review". Episode Review will show all episodes that qualifies for the selected timeframe and other filters. 

Here is a small example dashboard to create your own links to episodes. 

<dashboard version="1.1">
  <label>Link To Episode</label>
        <title>Active Episodes</title>
          <query>| inputlookup itsi_notable_group_system_lookup where is_active=1
| eval itsi_group_id=_key, _time = last_time
| table _time, title, itsi_group_id
| sort - _time limit=0</query>
        <option name="drilldown">cell</option>
          <link target="_blank">/app/itsi/itsi_event_management?episodeid=$row.itsi_group_id$</link>



0 Karma


That works .. Thanks!

0 Karma


But having trouble getting the link to work if the episode is outside a 24 hr timespan .. which is the default for the Episode Review page .. says no results for episodes outside the past 24 hrs. 

0 Karma


Found the problem .. need to pass earliest and latest to the link .. thanks

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...