Splunk IT Service Intelligence

Splunk ITSI Bidirectional Ticketing Issue?

prafullwt
New Member

Hello All,

I'm using Splunk ITSI app to create incidents in ServiceNow from Splunk ITSI based on Episode Review, that is using actions in the notable event aggregation policy.

I’m facing problem in running default correlation search of Bidirectional Ticketing.
While troubleshooting I can see inputlookup itsi_notable_event_external_ticket isn’t getting updated and couldn’t find it anywhere. However in this input lookup one entry exists which we made last week.

Below is the default search. datamodel Ticket_Management and sourcetype="snow:incident" is working fine but inputlookup isn’t getting updated which is why I am unable to test as ticket_id is defind there as well.

| datamodel Ticket_Management Incident search | rename All_Ticket_Management.ticket_id as ticket_id
| join ticket_id [search sourcetype="snow:incident" | where indextime > now() - 60]
| join ticket_id [| inputlookup itsi_notable_event_external_ticket | rename tickets.* as *]
| rename event_id as group_id | fields - dv
* | eval bidirectional_ticketing=1

as per my investigation that lookup isn't getting updated. so here in i suspect problem lies.
Can you please suggest any way to troubleshoot this ?

Labels (1)
0 Karma

szhou_splunk
Splunk Employee
Splunk Employee

Hi, @prafullwt , would you check the followings in step by step?

  1. Check if ServiceNow's incident modinput is running.
  2. Check if rules engine is running by going into "Searches, reports, and alerts" and search for itsi_event_grouping for App: SA-ITOA.
  3. If all above 2 are enabled, then check if the Bidirectional Ticketing correlation search generating events by search for index=itsi_tracked_alerts bidirectional_ticketing=1 , if there is no events found in this step, the ticket updating will not happen.
  4. If step 3 showing the events, you can compare the fields of the events with the aggregation policy you set up, see if the field names and values matches any events generated in step 3. It the criteria doesn't match in what you set in aggregation policy, the ticket updating will not happen as well.
0 Karma

santosh_sshanbh
Path Finder

How and where to check this?

  1. Check if ServiceNow's incident modinput is running.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...