Splunk IT Service Intelligence

Issue in creating Episodes in Splunk ITSI

Manjunath_Splnk
Loves-to-Learn

Hi All,

We have installed splunk ITSI 4.15.0 on search head clusters. We are facing challenges in creating episodes and we are seeing the below error:
ERROR [itsi_re(reId=Tksg,reMode=Preview)] [main] CommonUtils:331 - FunctionName=isAnyClusterInRollingRestartOrUpgrade, Status=Failed, ErrorMessage="Skipping cluster rolling restart status check. Unable to get cluster config due to exception calling REST endpoint"
on our search head servers.

Also ITSI Analytics Monitoring dashboard shows "The number of Rules Engine Processes as zero".
We checked the cluster status and there is no issue with the clustering.
Can anyone please suggest how to resolve this issue.

Labels (1)
0 Karma

srauhala_splunk
Splunk Employee
Splunk Employee

Hi @Manjunath_Splnk 

Check out https://docs.splunk.com/Documentation/ITSI/4.15.0/EA/TroubleshootRE to help you troubleshoot what the issue could be. 

Verify that you have Java installed. Check the ITSI health check and Event analytics dashboards for issues. 

The log message you have posted is about: https://docs.splunk.com/Documentation/ITSI/4.15.0/EA/RollingRestart and might not the the reason to why the rule engine does not start. 

/Seb 

0 Karma

hh
Loves-to-Learn

Hi @srauhala_splunk ,

 

I have checked the ITSI Event Analytics Dashboard. I see Java 11 is installed. Additionally I see below errors as well. Rules engine status is 1.  But episodes are are in sync in the search head members and also it is not getting updated properly.

12:02:00,629 ERROR [itsi_re(reId=ypQe)] [main] TaskManager:297 - Status=Failed, FunctionName=SetupSplunkServices, ErrorMessage="no protocol: ", StackTrace=java.net.MalformedURLException: no protocol: at java.base/java.net.URL.<init>(URL.java:645) at java.base/java.net.URL.<init>(URL.java:541) at java.base/java.net.URL.<init>(URL.java:488) at com.splunk.itsi.event.management.sdk.SplunkServiceUtils.getService(SplunkServiceUtils.java:53) at com.splunk.itsi.rule.engine.core.TaskManager.setup(TaskManager.java:1205) at com.splunk.itsi.rule.engine.core.TaskManager.<init>(TaskManager.java:295) at com.splunk.itsi.search.chunk.RulesEngineSearch.main(RulesEngineSearch.java:49)

 

ERROR [itsi_re(reId=OuPx,reMode=RealTime)] [itsiruleengine-akka.actor.default-dispatcher-2] CommonUtils:331 - FunctionName=isAnyClusterInRollingRestartOrUpgrade, Status=Failed, ErrorMessage="Skipping cluster rolling restart status check. Unable to get cluster config due to exception calling REST endpoint".

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...