Splunk itsi creating duplicate incidents on SNOW

[arhaan015]

Hi all,

My splunk itsi instance is connected to snow. All the episodes are Triggering with count values greater than 10

Issue:- for each new episode count on splunk(splunk number) multiple tickets are getting created all with same unique snow incdient no. But with different splunk number.

Please help where is the issue?

Is there any way we can suppress this with rules on itsi.?

[eduncan]

In your actions of your agg policy you need to choose:  if the events in this episode are exactly equal to 1 and that way it creates one episode, not one every time a NE is added.  This way all subsequent NE's are in the episode and linked to ONE Servicenow Incident.