Splunk ITSI

ITSI Episodes Data Inconsistent

krunoslav
Engager

Hello,

When fetching the episodes from ITSI via REST (https://hostname:8089/servicesNS/fsspl06/itsi/event_management_interface/notable_event_group?filter={"status":"1","severity":{"$gte":"3"}}) a list of several episodes with status "New" is obtained. However, in the ITSI GUI, in the Episode Review tab, a search for all new episodes over all time returns no results. How is this possible? Any clues on how to debug this? Thanks

Labels (2)
Tags (2)
0 Karma

eduncan
Splunk Employee
Splunk Employee

If you are sure that even in the itsi_summary index that the groupid's for the ones retrieved via rest are NOT there, then I'd open a support case.

0 Karma

eduncan
Splunk Employee
Splunk Employee

Need more info on your filter.  What is set for Status Filter and Severity Filter?

0 Karma

krunoslav
Engager

In ITSI GUI the Status is set to New and the severity is not set

0 Karma

eduncan
Splunk Employee
Splunk Employee

Also if you search the. index=itsi_grouped_alerts do you see the groupID of the same episodes you got from the REST API?

 

0 Karma

krunoslav
Engager

No, the episodes returned via REST are not found in the index.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...