When you create a new service analyzer, you start with a standard service analyzer view, then you customize it and save it. See https://docs.splunk.com/Documentation/ITSI/4.0.2/User/Createcustomserviceanalyzers For example, it you only want to show the "Active Directory" service, then you would filter it to this service and click Save. ... View more

You are correct, the issue has not been fixed yet. It is issue # ITSI-918. Sorry about the inconvenience. Some information on what you are trying to accomplish may be helpful. Are you trying to create an empty glass table or a glass table with widgets? ... View more

There is a Troubleshooting chapter in the ITSI Installation and Configuration manual here: http://docs.splunk.com/Documentation/ITSI/3.1.3/Configure/Installationandconfigurationconsiderationsandissues ... View more

The workaround is to create the glass table through the UI until a fix can be made. ... View more

One of the engineers on the ITSI team tested out creating a glass table using the endpoint and it appears to be broken. We have filed a bug to fix this issue. Sorry for the inconvenience. ... View more

You can find information on creating glass tables in ITSI here: http://docs.splunk.com/Documentation/ITSI/3.1.1/User/BuildGlassTable ... View more

There are multiple folders for ITSI. Place all of them into Splunk\etc\apps ... View more

Hi, I just posted a reply to your comment but I don't see it so sorry if you see a comment from me twice. Only the latest version of add-ons are supported, which is why you can only download v 2.0.0 (the latest version) of the Remedy add-on from Splunkbase and why you can only find v 2.0.0 of the doc. Only version 2.0.0 of the Remedy add-on contains support for integration with ITSI notable events. So getting the earlier version will not do you any good. As stated in the requirements in the doc, only Remedy v. 9.1 and later is supported. ... View more

Yes, there was a prior release of the Remedy add-on, version 1.0.0, but three things: Only the latest release of an add-on is supported which is why 2.0.0 is the only version of the doc you can find for the Remedy add-on and which is why it is the only version of the add-on that can be downloaded from Splunkbase. My understanding is v. 1.0.0 of the add-on does not support Remedy integration with ITSI. Only version 2.0.0 of the add-on has support for integration with ITSI notable events so that you can create a Remedy ticket from an ITSI notable event. As I stated before (and as stated in the doc) integration is not supported for Remedy versions prior to 9.1. ... View more

The Machine Learning Toolkit requires Splunk Enterprise 6.4 or later. The MLTK and PSC are separate apps that have to be installed in addition to Splunk Enterprise. Refer to installation instructions here: http://docs.splunk.com/Documentation/MLApp/2.0.1/User/Installandconfigure The installation instructions referenced above also cover distributed deployments. ... View more

The MLTK doc been updated with this information: http://docs.splunk.com/Documentation/MLApp/2.0.0/User/Installandconfigure Information for cloud installs has also been added. ... View more

In the context of IT Service Intelligence, KPI base searches can be used to share a search definition across multiple KPIs that use the same data source. For example, you may have several KPIs that are based on the same sets of source events, but are measuring on different fields. You can create base searches to consolidate these KPIs, reduce search load, and improve search performance. For info on KPI base searches, see http://docs.splunk.com/Documentation/ITSI/2.4.0/Configure/HowtocreateKPIsearches#Create_KPI_base_searches ... View more

Version 4.0.0 contains significant performance improvements according to our internal testing. Would be good to hear if there is a noticeable improvement from a customer ... View more

Good to hear! ... View more

The new version of the add-on, version 4.0.0, was released on Monday! You can download it here: https://splunkbase.splunk.com/app/3197 You can find documentation here: http://docs.splunk.com/Documentation/AddOns/latest/OPSEC-LEA/About This version supports Splunk Enterprise 6.4, Check Point R80, and the SHA256 certificate. This version replaces the older version. If you have an older version, you need to remove or disable the previous version before installing the new version. ... View more

What operating system are you using? One suggestion: disable the add-on first, then try upgrading and see if that works. This was a workaround for another add-on that had issues with upgrading. ... View more

Please see the "Deploy and Use Splunk DB Connect" section of doc for single-instance and distributed deployments: http://docs.splunk.com/Documentation/DBX/2.1.3/DeployDBX/Singleserverdeployment Installing DB Connect on an indexer is not recommended, but it can work for small customers. For instance, if you've got one indexer and don't plan to add more hardware, it would work. The catch is that installing it on an indexer means that gathering data is competing with the indexing and search. Another option could be to install a Universal Forwarder on the database to get the files. However, you would have to configure the DB Connect inputs manually in the .conf files, you would not be able to use the UI from a UF. ... View more

My understanding is you need to have DB Connect and MySQL add-on installed on search heads and heavy forwarders only. Not indexers. From the documentation ( http://docs.splunk.com/Documentation/AddOns/latest/MySQL/Hardwareandsoftwarerequirements#DB_Connect_v2 😞 You must have Splunk DB Connect v2 installed to your heavy forwarders to collect MySQL performance and configuration logs with this add-on. The Splunk Add-on for MySQL works with DB Connect version 2.0 and above. See "Deploy and Use Splunk DB Connect" in the Splunk DB Connect manual for information. I want to state up front that I do not have experience in the field, but I confirmed with the developer of the app that MySQL add-on needs to be installed on heavy forwarders and the heavy forwarder with the add-on must be installed on the MySQL box if you are collecting local logs. ... View more

The following known issue has just come to light: ADDON-8448 Splunk Add-on for Check Point OPSEC LEA does not support the 6.4 release of the Splunk platform. The add-on requires version 6.3. ... View more