Splunk IT Service Intelligence

Splunk itsi creating duplicate incidents on SNOW

New Member

Hi all,

My splunk itsi instance is connected to snow. All the episodes are Triggering with count values greater than 10

Issue:- for each new episode count on splunk(splunk number) multiple tickets are getting created all with same unique snow incdient no. But with different splunk number.


Please help where is the issue?


Is there any way we can suppress this with rules on itsi.?

Labels (1)
Tags (1)
0 Karma

Splunk Employee
Splunk Employee

In your actions of your agg policy you need to choose:  if the events in this episode are exactly equal to 1 and that way it creates one episode, not one every time a NE is added.  This way all subsequent NE's are in the episode and linked to ONE Servicenow Incident.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!