Splunk Search

ITSI Grouping

New Member


I am using ITSI grouping feature where we need to match the eventid from the two indexes of ITSI, index=itsi_notable_audit and index=itsi_tracked_alerts. The issue is that itsi_notable_audit index is taking the group id ( which groups similar events) as event_id whereas itsi_tracked_alerts is taking eventid of every event not by group.

Now I want to compare the event_id from both the indexes but i cant do so because of itsi grouping. Please help/advice.


Tags (2)
0 Karma

Splunk Employee
Splunk Employee

The field "event_id" is mostly used for the notable events, in the itsi_tracked_alerts field.
but in versions older than 3.* it was also used for the group id in the index=itsi_grouped_alerts, and since 4.* for the Episodes ids too.
This can be confusions, as there is also an itsi_group_id field and when you use the API, the id may be referring to the notable or to the group...

The best way to avoid confusion is to do an eval or a rename to create a second field group_id to avoid confusion, depending of the context of the data.

0 Karma


Hi renjith.nair,
Have u checked splunk docs below? This might help you.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!