You need to click Add Lane > Add Event Lane to add an event lane. There's no way to click on an individual KPI lane and have the event lane appear. Follow the docs here: https://docs.splunk.com/Documentation/ITSI/latest/User/Deepdiveswimlanes#Add_a_new_event_lane ... View more

Abbreviation is turned on by default in the Configurations panel. This turns all big numbers and floating point numbers into integers with a prefix that tells where the decimal point is: ... View more

I suggest creating one "parent" service of all of your applications. In other words, create one service and make all of your applications "dependent services" of this parent service: https://docs.splunk.com/Documentation/ITSI/latest/Configure/Addservicedependencies. In the service analyzer tree view, all of these applications would be on one layer, and they'd all be pointing up to the single parent service on the next layer up. Then you can create a custom service analyzer view that only displays that one parent service: https://docs.splunk.com/Documentation/ITSI/latest/User/Createcustomserviceanalyzers ... View more

I'd suggest cloning the glass table to the beta editor introduced in 4.2.0. When you configure a drilldown, it provides the option to select "Open in new tab": https://docs.splunk.com/Documentation/ITSI/4.3.0/User/BuildbetaGT#Configure_drilldowns The beta framework will soon become the official and only framework, so it is recommended that you begin to use this new framework exclusively. ... View more

It was discovered that entity alias filtering wasn't doing what it should have been doing, so it was removed in version 4.2.0. Please see https://docs.splunk.com/Documentation/ITSI/4.2.0/ReleaseNotes/Removedfeatures ... View more

The ITSI sandbox was removed several releases ago. There are currently no plans to replace it. ... View more

The ITSI sandbox was removed several releases ago. There are currently no plans to replace it. ... View more

This issue was fixed in version 4.0.4 (https://docs.splunk.com/Documentation/ITSI/4.0.4/ReleaseNotes/Fixedissues#Service_Definition). Note that once you upgrade to a version with the fix, you need to run the kvstore_to_json mode 4 option. See the version-specific upgrade notes for 4.0.4 here: https://docs.splunk.com/Documentation/ITSI/4.4.0/Install/VersionNotes As a workaround for pre-4.0.4 versions, you can open the service and go to the Entities tab. If you see an entity with a "does not match" rule, remove the rule and find a way to match to an entity differently that does not use the “does not match” rule. ... View more

There is no privacy control in terms of Episode Review views. If any events are associated with a team that an analyst doesn't belong to, they will not see those events in the dashboard. ... View more

As of 4.0, ITSI ships with an internal license stack called IT Service Intelligence Internals DO NOT COPY stack. This might be causing the issue. https://docs.splunk.com/Documentation/ITSI/4.0.0/Configure/DeploymentPlanning#ITSI_license_requirement ... View more

You can actually create a partial backup through the UI: https://docs.splunk.com/Documentation/ITSI/latest/Configure/BackupandRestoreITSIconfig#Create_a_partial_backup When you select a service to back up, ITSI also backs up the following objects: -KPI base searches -Threshold templates -Teams When you select a service to back up, you can choose whether or not to back up the following objects: -Dependent services -Entities that match service entity rules -Linked service template The dependency between the service and these objects breaks if you do not choose to back up the associated object: -If you back up a service that has dependent services without also backing up the dependent services, the service will no longer be dependent on the services after restoring. -If you back up a service without backing up the entities that match the service entity rules, the entities will no longer be associated with the service if the entities do not exist in the restored environment. -If you back up a service that is linked to a service template without also backing up the service template, the service will no longer be linked to the service template after restoring. ... View more

Hi Manish, there's currently no way to rename services or KPIs in bulk. ... View more

Hi Harish, the best way would be to create a a service template containing that KPI base search, and then link all 500 of those services to the service template: https://docs.splunk.com/Documentation/ITSI/latest/Configure/Linkservicetotemplate You can't bulk link services to templates through the UI, but you can achieve this through the REST API: https://docs.splunk.com/Documentation/ITSI/latest/RESTAPI/ITSIRESTAPIreference#itoa_interface.2Fservice.2F.3C_key.3E.2Fbase_service_template ... View more

What's the version of ITSI? Predictive Analytics tab shows starting from ITSI 4.0. ... View more

Looks like the classic glass tables don't support passing parameters along with drilldown URL. Although I can see how we try to hardcode earliest and latest args in dashboard drilldown URL. Latest would take whatever was selected in the global time picker. Earliest is the value selected for the widget. So in theory it would just pass the right time range without having to specify anything. We do support parameters for beta glass tables. it looks like 'http://splunk.com?$TimeRange.earliest$'. I would suggest checking out the beta glass table editor: https://docs.splunk.com/Documentation/ITSI/latest/User/BuildbetaGT ... View more

HI Vikram, the ITSI sandboxes were removed several releases ago. ... View more

Did this occur after an upgrade? Can you try the troubleshooting steps here? https://docs.splunk.com/Documentation/ITSI/latest/Install/Troubleshoot#Why_are_things_missing_after_I_upgrade.3F ... View more

In a future release we hope to have a "Special Days" feature that takes care of thresholds for special days like Black Friday, Christmas, and other significant days for your organization. However, this functionality currently does not exist 😞 Keep your eye on the new features lists for each release and hopefully it'll be there soon: https://docs.splunk.com/Documentation/ITSI/latest/ReleaseNotes/Newfeatures ... View more

Yes, you can use shapes and icons as KPI widgets. When the KPI severity level changes, the color of the shape or icon changes accordingly: https://docs.splunk.com/Documentation/ITSI/latest/User/BuildGlassTable#Use_shapes_and_icons_as_glass_table_widgets ... View more

The single KPI alerting functionality was introduced in version 4.2.0: https://docs.splunk.com/Documentation/ITSI/latest/Configure/KPIalerting ... View more

You will find a lot of insights and tutorials in this link below, I use it all the time when I have some difficulties. https://towardsdatascience.com/time-series-forecasting-with-splunk-part-i-intro-kalman-filter-46e4bff1abff There's also the Machine Learning Toolkit docs: https://docs.splunk.com/Documentation/MLApp/4.3.0/User/About ... View more

Hi Andy, here are the docs for configuring tokens in emails. If this doesn't help, please let me know how we can enhance the docs https://docs.splunk.com/Documentation/ITSI/latest/User/Setupandrunnotableeventactions#Send_an_email ... View more

The service analyzer view is mainly for monitoring and root cause analysis (https://docs.splunk.com/Documentation/ITSI/latest/User/ServiceAnalyzer) If you want to see the actual search that's powering the service, you'd have to go into the service definition (Configure > Services, then open the specific service). ... View more

Is this an ITSI issue or a Splunk Enterprise issue? Can you please give some more context? ... View more