Splunk ITSI

Multiple Remedy Tickets are getting generated for the Episode having multiple notables

psoni1
Observer

We are facing some issue while creating ticket,

For the first run of correlation, notable events are generating and grouping it into Episode, however, Its creating multiple(for each events in the episode) tickets for the episode at the first time, from the second run notables are getting duplicated into the episode, all the new notables are getting updated to the ticket which created with first alert in the episode in the first run of correlation search.

Please let us know if it’s known behavior, if yes what is the logic behind it? or any specific setting/fields needs to be modified while raising the tickets raising tickets ?

Labels (1)
Tags (3)
0 Karma

eduncan
Splunk Employee
Splunk Employee

Make sure that in the corr search you have the Notable Event Identifier fields set and not just leaving it at 'source'.  These fields are used to identify the NE as unique.  For instance you might want to use %host%%eventtype%%Message%.  This will let ITSI know that the NE is the exact same one as one already created and it will prevent duplicates.

When wanting to create a Remedy ticket you will want to make sure that in the Action tab of the Aggregation policy you choose something like When this event occurs:  Severity greater than or equal to Medium, and then the action will be to create an event.  Agg policies create 1 ticket per episode, not per NE.

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...