Splunk IT Service Intelligence

how to remove duplicate alerts from episode review.

Hemant1
Explorer

we are getting duplicate alerts in episode review .
need to know what required change needs to be done and where so we will not see duplicate alerts.
please help here .

Thanks in advance.

Tags (2)
0 Karma

szhou_splunk
Splunk Employee
Splunk Employee

Hi, @Hemant1 ,
Did you see the issue consistently or very often? If yes, it may related to phased_execution_mode which causes multiple instance of rules engine running that generate multiple episodes and grouped events. You can try to set the following properties in etc/system/local/limits.conf:
[search]
phased_execution_mode = auto
And restart the itsi_event_grouping savedsearch.
If it still doesn't work, please check what is the version of ITSI and Splunk Enterprise, and check how many rules engine processes running on SHs.

Hemant1
Explorer

@szhou_splunk we have performed the same suggested by you,but unfortunately it didnt work .
please help here .

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...