Splunk IT Service Intelligence

ITSI - Episode Review - 1 KPI

arthurva
Observer

I'm very new to Splunk and ITSI. We have created a service for VMware VMs. The Service has several KPIs like memory and CPU. A few of the VMs have CPUs in Critical status. Episode Review shows 0 episodes. Is it possible to have the specific servers show up in Episode Review?

0 Karma

arthurva
Observer

I'm stuck doing something on the first link.

...but we’re going to wind up modifying it slightly so we’ll duplicate the existing rule and make our modifications to the copy...

How do you duplicate it? I don't see that option.

0 Karma

szhou_splunk
Splunk Employee
Splunk Employee

There is an "Edit" dropdown in "Actions" column and you can click "Clone" from the dropdown to duplicate it.
Generally, in order to show these events in Episode Review, you need to create some of correlation searches that generate the events, and use Notable Event Aggregation Policy (Under Configuration dropdown manual) to include these events for that Policy, then you will see these events(got grouped into Episode by similarity) in Episode Review.

0 Karma

arthurva
Observer

I'll start reading them. Thank you.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...