Splunk IT Service Intelligence

Multiple event_id is created in itsi_tracked_alerts from correlation searches

bpratap
Explorer

Need help in understanding Notable event, I am using correlation search to create Notable event, where my search has “time_range and schedule as 5min” which return single result(ie single event)

However I am able to see 2 event_id within itsi_tracked_alerts index for same search thus resulting into Notable event count 2 in Episode review in ITSI.

index=itsi_tracked_alerts sourcetype="itsi_notable:event" project=”abc” :- 2 event with 2 different event_id.

Correlation serach:---- generates only 1 event.

I am not sure why 2 event are created in “itsi_tracked_alerts” for project “abc”. Where according to correlation serach it should only generate 1 event id.

Please help

0 Karma

yannK
Splunk Employee
Splunk Employee
  • Is your search returning more than 1 event when it runs ?
    If it does, maybe massage your events, like using a "|dedup " or "| head 1" to trim them before the notables are created.

  • If your events results are unique but get indexed twice
    check the _indextime of the notable events, to figure when they were created.
    Check if you have a useack=true enable in the outputs.conf of your search-head (it can cause the forwarder to attempt to send the same events multiple time in case of network failure)
    check if you are not cloning your data to 2 sets of indexers

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...