How about Activities -> Jobs , and search for itsi_event_grouping? ... View more

Would you click the "View Recent" link see if it is running? Also check if the index itsi_grouped_alerts has events. ... View more

You can go to Settings -> Searches, reports and alerts -> Search for "itsi_event_grouping" for all apps. And you can verify if itsi_event_grouping is running or failed. ... View more

Would you check if itsi_event_grouping saved search is running? Are you able to generate episodes without enabling smart mode? ... View more

Hi, @Hemant1 , Did you see the issue consistently or very often? If yes, it may related to phased_execution_mode which causes multiple instance of rules engine running that generate multiple episodes and grouped events. You can try to set the following properties in etc/system/local/limits.conf: [search] phased_execution_mode = auto And restart the itsi_event_grouping savedsearch. If it still doesn't work, please check what is the version of ITSI and Splunk Enterprise, and check how many rules engine processes running on SHs. ... View more

You can create 2 aggregation policies with the same filtering criteria, and 1st one use service as split by , and 2nd one use entity as split by . ... View more

Hi, would you check if the saved search 'XXX-XXX-XXXX' exists and enabled, and accessible by ITSI? You can test the correlation search string by click "Run Search" before saving the correlation search. ... View more

Hi, @prafullwt , which version did you upgrade from and to which version? Maybe it is being migrated. Did you see any errors with the following search? index=_internal sourcetype="itsi_internal_log" source="*itsi_upgrade*" ... View more

Hi, @Hemant1 maybe you hit the limit of max of 50K records returned by subsearch, we can change the limit in limits.conf but I encourage you not using join command here , maybe you can use "*stats ... by UserID" instead. You can also refer to https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html. ... View more

Yes, entity linking supports for Smart Grouping start from 4.4.0. ... View more

You can try adding the following lines to $SPLUNK_HOME/etc/apps/SA-ITOA/local/itsi_notable_event_status.conf: [2] end=1 And set "If the number of events in this episode is greater than or equal to 1163" then send alerts in Aggregation Policy Action Rules page. Then you will keep getting alerts until the episode is ack'ed. Refer to https://docs.splunk.com/Documentation/ITSI/4.3.1/Configure/itsi_notable_event_status.conf ... View more

Hi, @prafullwt , would you check the followings in step by step? Check if ServiceNow's incident modinput is running. Check if rules engine is running by going into "Searches, reports, and alerts" and search for itsi_event_grouping for App: SA-ITOA. If all above 2 are enabled, then check if the Bidirectional Ticketing correlation search generating events by search for index=itsi_tracked_alerts bidirectional_ticketing=1 , if there is no events found in this step, the ticket updating will not happen. If step 3 showing the events, you can compare the fields of the events with the aggregation policy you set up, see if the field names and values matches any events generated in step 3. It the criteria doesn't match in what you set in aggregation policy, the ticket updating will not happen as well. ... View more

Is this a search head cluster or single SH environment? Would you check if replicate.macros=true in distsearch.conf if you are running on search head cluster? ... View more

What's the version of ITSI? Predictive Analytics tab shows starting from ITSI 4.0. ... View more

From ITSI 4.0, you can ack an Episode but not for event, you can set Episode View to On to see the list of episode. Episode is a group of events so you don't have to do the operation for every event one by one. Please see https://docs.splunk.com/Documentation/ITSI/4.1.2/User/OverviewofITSINotableEventsReview for more information. ... View more

There is an "Edit" dropdown in "Actions" column and you can click "Clone" from the dropdown to duplicate it. Generally, in order to show these events in Episode Review, you need to create some of correlation searches that generate the events, and use Notable Event Aggregation Policy (Under Configuration dropdown manual) to include these events for that Policy, then you will see these events(got grouped into Episode by similarity) in Episode Review. ... View more