Splunk IT Service Intelligence

ITSI Episode entities from correlation searches

cmeerbeek
Path Finder

I have a ITSI 4.0.x question regarding Episodes...

How do you connect an Entity to the results of a Correlation Search?

I have configured the Entity Lookup Field and when I look at the individual events the entity_title field is correctly filled but when I go to Episodes the entity_title column is empty and Impacted Entities in the Episode Details screen is also empty....
When I go to the Entity Screen and select Entity Health the new screen shows me the single events but again not the Episodes.

0 Karma

esnyder_splunk
Splunk Employee
Splunk Employee

Smart Mode supports entity linking from ITSI version 4.4.0.

cmeerbeek
Path Finder

Today I've discovered that if I disable Smart Grouping the Impacted Entities do work and are being filled. So it seems like an issue with Smart Grouping? The Smart Grouping docs are a little bit to "simple" to know how this should work.

0 Karma

szhou_splunk
Splunk Employee
Splunk Employee

Yes, entity linking supports for Smart Grouping start from 4.4.0.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...