Makes it possible to change status/severity/owner via spl, example: | makeresults | eval field='status', episodeId='0000-000-000-0000', value='5' | itsiedit fieldField=field episodeidField=episodeId valueField=value This is a command wrapper around the ITSI API, and therefor you're able to use the same values as described here: https://docs.splunk.com/Documentation/ITSI/latest/EA/EpisodeAPI