Splunk IT Service Intelligence

How to suppress Notable Events in ITSI?

ManjunathN
Engager

Hi,

 

How to suppress the notable events in Splunk itsi ?

And when an episode breaks will the related notable events gets cleared? 

And when an new episode gets created the related notable events count will be a fresh count from the time of episode creation or it will be a accumulated from the previous count. Please clarify. Thanks!

Labels (1)
0 Karma

lperini_splunk
Splunk Employee
Splunk Employee

How to suppress the notable events in Splunk itsi ?

Configuration > Correlation Searches > Open the Correlation Search > Advanced Options
For more information:

https://docs.splunk.com/Documentation/ITSI/4.14.0/EA/ConfigCS#Advanced_Options

And when an episode breaks will the related notable events gets cleared? 

No, the notables are not cleared. What happens is: a new episode is created, and the new notables are going to this new episode. So the notables that came before this "break" are kept in the previous episode.

https://docs.splunk.com/Documentation/ITSI/4.14.0/EA/FilteringCriteria#Break_episode

when an new episode gets created the related notable events count will be a fresh count from the time of episode creation or it will be a accumulated from the previous count. 

It will be a fresh count from the time of the episode creation.

 

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...