Splunk ITSI

Episode page is not loading any data in ITSI app version 4.0.3

mbagali_splunk
Splunk Employee
Splunk Employee

Episode page is not loading any data in ITSI app version 4.0.3, We see below errors:

JSON parsing of _raw field= failed with the following error, so skipping event:

JSON parsing of _raw field=$xxxxxxxxxxx$;$itsi_tracked_alerts$ failed with the following error, so skipping event:

0 Karma
1 Solution

mbagali_splunk
Splunk Employee
Splunk Employee

This is a expected behavior when the events details and fields are very long.

This has been noted and published as known issue in https://docs.splunk.com/Documentation/ITSI/4.0.2/ReleaseNotes/Knownissues .

Correlation/Notable events fields have no length safeguard, and can be exceed the default splunk limits for parsing (truncate or json parsing), causing those events to be unusable.

The work around would be:

Workaround:
Keep the events fields smaller, by changing the correlation searches.
Or Optimize the sourcetypes in ITSI, to raise the truncate limits for them to match the limit used for the regex (100000 at least) And provide warnings to tell the customer that the issue is happening, and link to the docs to fix

example of props

[itsi_notable:event]
KV_MODE = none
INDEXED_EXTRACTIONS = JSON
TRUNCATE=100000

[itsi_notable:group]
KV_MODE = none
INDEXED_EXTRACTIONS = JSON
TRUNCATE=100000

View solution in original post

mbagali_splunk
Splunk Employee
Splunk Employee

This is a expected behavior when the events details and fields are very long.

This has been noted and published as known issue in https://docs.splunk.com/Documentation/ITSI/4.0.2/ReleaseNotes/Knownissues .

Correlation/Notable events fields have no length safeguard, and can be exceed the default splunk limits for parsing (truncate or json parsing), causing those events to be unusable.

The work around would be:

Workaround:
Keep the events fields smaller, by changing the correlation searches.
Or Optimize the sourcetypes in ITSI, to raise the truncate limits for them to match the limit used for the regex (100000 at least) And provide warnings to tell the customer that the issue is happening, and link to the docs to fix

example of props

[itsi_notable:event]
KV_MODE = none
INDEXED_EXTRACTIONS = JSON
TRUNCATE=100000

[itsi_notable:group]
KV_MODE = none
INDEXED_EXTRACTIONS = JSON
TRUNCATE=100000

Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...