Splunk IT Service Intelligence

how to remove duplicate alerts from episode review.

Hemant1
Explorer

we are getting duplicate alerts in episode review .
need to know what required change needs to be done and where so we will not see duplicate alerts.
please help here .

Thanks in advance.

Tags (2)
0 Karma

szhou_splunk
Splunk Employee
Splunk Employee

Hi, @Hemant1 ,
Did you see the issue consistently or very often? If yes, it may related to phased_execution_mode which causes multiple instance of rules engine running that generate multiple episodes and grouped events. You can try to set the following properties in etc/system/local/limits.conf:
[search]
phased_execution_mode = auto
And restart the itsi_event_grouping savedsearch.
If it still doesn't work, please check what is the version of ITSI and Splunk Enterprise, and check how many rules engine processes running on SHs.

Hemant1
Explorer

@szhou_splunk we have performed the same suggested by you,but unfortunately it didnt work .
please help here .

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...