Splunk Search
Highlighted

ITSI Grouping

New Member

Hi,

I am using ITSI grouping feature where we need to match the eventid from the two indexes of ITSI, index=itsinotableaudit and index=itsitrackedalerts. The issue is that itsinotableaudit index is taking the group id ( which groups similar events) as eventid whereas itsitracked_alerts is taking eventid of every event not by group.

Now I want to compare the event_id from both the indexes but i cant do so because of itsi grouping. Please help/advice.

thanks

Tags (2)
0 Karma
Highlighted

Re: ITSI Grouping

Contributor

Hi renjith.nair,
Have u checked splunk docs below? This might help you.
http://docs.splunk.com/Documentation/ITSI/4.0.0/User/EnableSmartMode

0 Karma
Highlighted

Re: ITSI Grouping

Splunk Employee
Splunk Employee

The field "eventid" is mostly used for the notable events, in the itsitrackedalerts field.
but in versions older than 3.* it was also used for the group id in the index=itsi
groupedalerts, and since 4.* for the Episodes ids too.
This can be confusions, as there is also an itsi
group_id field and when you use the API, the id may be referring to the notable or to the group...

The best way to avoid confusion is to do an eval or a rename to create a second field group_id to avoid confusion, depending of the context of the data.

0 Karma