Issue in creating Episodes in Splunk ITSI

[Manjunath_Splnk]

Hi All,

We have installed splunk ITSI 4.15.0 on search head clusters. We are facing challenges in creating episodes and we are seeing the below error:
ERROR [itsi_re(reId=Tksg,reMode=Preview)] [main] CommonUtils:331 - FunctionName=isAnyClusterInRollingRestartOrUpgrade, Status=Failed, ErrorMessage="Skipping cluster rolling restart status check. Unable to get cluster config due to exception calling REST endpoint"
on our search head servers.

Also ITSI Analytics Monitoring dashboard shows "The number of Rules Engine Processes as zero".
We checked the cluster status and there is no issue with the clustering.
Can anyone please suggest how to resolve this issue.

[srauhala_splunk]

Hi @Manjunath_Splnk 

Check out https://docs.splunk.com/Documentation/ITSI/4.15.0/EA/TroubleshootRE to help you troubleshoot what the issue could be. 

Verify that you have Java installed. Check the ITSI health check and Event analytics dashboards for issues. 

The log message you have posted is about: https://docs.splunk.com/Documentation/ITSI/4.15.0/EA/RollingRestart and might not the the reason to why the rule engine does not start. 

/Seb 

[hh]

Hi @srauhala_splunk ,

I have checked the ITSI Event Analytics Dashboard. I see Java 11 is installed. Additionally I see below errors as well. Rules engine status is 1.  But episodes are are in sync in the search head members and also it is not getting updated properly.

12:02:00,629 ERROR [itsi_re(reId=ypQe)] [main] TaskManager:297 - Status=Failed, FunctionName=SetupSplunkServices, ErrorMessage="no protocol: ", StackTrace=java.net.MalformedURLException: no protocol: at java.base/java.net.URL.<init>(URL.java:645) at java.base/java.net.URL.<init>(URL.java:541) at java.base/java.net.URL.<init>(URL.java:488) at com.splunk.itsi.event.management.sdk.SplunkServiceUtils.getService(SplunkServiceUtils.java:53) at com.splunk.itsi.rule.engine.core.TaskManager.setup(TaskManager.java:1205) at com.splunk.itsi.rule.engine.core.TaskManager.<init>(TaskManager.java:295) at com.splunk.itsi.search.chunk.RulesEngineSearch.main(RulesEngineSearch.java:49)

ERROR [itsi_re(reId=OuPx,reMode=RealTime)] [itsiruleengine-akka.actor.default-dispatcher-2] CommonUtils:331 - FunctionName=isAnyClusterInRollingRestartOrUpgrade, Status=Failed, ErrorMessage="Skipping cluster rolling restart status check. Unable to get cluster config due to exception calling REST endpoint".