Splunk ITSI Error messages:

[Srini_551]

Hi All,

We are getting below error message ITSI rules_engine:

"ErrorMessage="One or more fields are missing to create episode state." in splunk which is stopping episode creation for some of the events.

However when we check the search results there are no null or empty field values for respective fields.

Please help me to fix this ASAP with a detailed steps.

Thanks in Advance to all.

[skramp]

In this case it is asking for an „Episode State“. Do you try to set episode state by an info in the event?