ITSI Grouping

[nikitakapoor109]

Hi,

I am using ITSI grouping feature where we need to match the eventid from the two indexes of ITSI, index=itsi_notable_audit and index=itsi_tracked_alerts. The issue is that itsi_notable_audit index is taking the group id ( which groups similar events) as event_id whereas itsi_tracked_alerts is taking eventid of every event not by group.

Now I want to compare the event_id from both the indexes but i cant do so because of itsi grouping. Please help/advice.

thanks

[yannK]

The field "event_id" is mostly used for the notable events, in the itsi_tracked_alerts field.
but in versions older than 3.* it was also used for the group id in the index=itsi_grouped_alerts, and since 4.* for the Episodes ids too.
This can be confusions, as there is also an itsi_group_id field and when you use the API, the id may be referring to the notable or to the group...

The best way to avoid confusion is to do an eval or a rename to create a second field group_id to avoid confusion, depending of the context of the data.

[nikita_p]

Hi renjith.nair,
Have u checked splunk docs below? This might help you.
http://docs.splunk.com/Documentation/ITSI/4.0.0/User/EnableSmartMode