Splunk IT Service Intelligence

IT Service Intelligence: How to get acknowledged notable events?

sboogaar
Path Finder

Is it possible to get a list with itsi acknowledged events?
I tried to get it based on the status like:

index=itsi_tracked_alerts status=2

But I get no results, however when I try:

index=itsi_notable_audit acknowledged

I will get events like:

{ [-]
activity: admin acknowledged notable event group
activity_type: Notable Event Group Update
event_id: 0cb32c45-2203-40e7-884c-73301b9da1e2

user: admin } Show as raw text
But the event_id is specific for the acknowledge action so I can not relate it to which event is acknowledged.
What I want to do is send an email with the acknowledged events (and the event description) when an event is acknowledged. Therefore im trying to make a savedsearch that gets all acknowledged events.

0 Karma
1 Solution

sboogaar
Path Finder

I solved it using:

index=itsi_notable_audit acknowledged 
| join event_id 
    [| inputlookup itsi_notable_event_group_lookup 
    | rename _key as event_id] 
| join event_id 
    [ search index=itsi_grouped_alerts 
    | rename itsi_group_id as event_id ] 
| table activity, itsi_group_description, _time

View solution in original post

0 Karma

sboogaar
Path Finder

I solved it using:

index=itsi_notable_audit acknowledged 
| join event_id 
    [| inputlookup itsi_notable_event_group_lookup 
    | rename _key as event_id] 
| join event_id 
    [ search index=itsi_grouped_alerts 
    | rename itsi_group_id as event_id ] 
| table activity, itsi_group_description, _time
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...