cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
lperini_splunk
Splunk Employee
Member since: ‎11-05-2018
‎02-24-2023
Community Statistics
Posts 10
Solutions 2
Karma Given 7
Karma Received 1
Member Since ‎05-11-2018
Activity Feed
View All

Re: How to download itsi prod kvstore and restore...

by Splunk Employee in Splunk IT Service Intelligence
‎02-24-2023 07:06 AM
‎02-24-2023 07:06 AM
you can use UI or kvstore_to_json script to do it.  https://docs.splunk.com/Documentation/ITSI/4.16.0/Configure/BackupandRestoreITSIconfig You can go to Splunk > ITSI > Configuration > Backup/Restore and upload the backup taken from the source environment and restore the ITSI objects.  If you decides to use kvstore_to_json method, you will need to go to the host (via terminal) and run the commands manually https://docs.splunk.com/Documentation/ITSI/4.16.0/Configure/kvstorejson   ... View more

Re: Filtering Criteria Aggregation policy in splun...

by Splunk Employee in Splunk IT Service Intelligence
‎09-29-2022 06:39 AM
‎09-29-2022 06:39 AM
I think you can limit the hosts in the Action Rules, something like that AND the number of events on the episode = 1 then trigger the create servicenow incident     ... View more

Re: ITSI Rules Engine stops with exception error

by Splunk Employee in Splunk IT Service Intelligence
‎09-26-2022 05:41 AM
‎09-26-2022 05:41 AM
  This is a know issue documented here https://docs.splunk.com/Documentation/ITSI/4.13.1/ReleaseNotes/Knownissues#Notable_Events Bug ITSI-24488 Rules engine search fails to start after upgrade to ITSI 4.13.0 Workaround: Move the jackson-core-2.10.0.jar and jackson-annotations-2.10.0.jar to the .bkup folder under $SPLUNK_HOME/etc/apps/SA-ITOA/lib/java/event_management/libs directory. ... View more

ITSI Rules Engine stops with exception error

by Splunk Employee in Splunk IT Service Intelligence
‎09-26-2022 05:39 AM
‎09-26-2022 05:39 AM
Here are the error messages 2022-09-26 12:38:02,976 ERROR [itsi_re(reId=cRdG)] [main] RulesEngineSearch:75 - RulesEngineTask=RealTimeSearch, Status=Stopped, FunctionMessage="java.lang.NoSuchMethodError: com.fasterxml.jackson.core.JsonParser.getReadCapabilities()Lcom/fasterxml/jackson/core/util/JacksonFeatureSet;" host = myhost = _internalsource = /opt/splunk/var/log/splunk/itsi_rules_engine.log sourcetype = itsi_internal_log 2022-09-26 12:38:02,976 ERROR [itsi_re(reId=cRdG)] [main] RulesEngineSearch:74 - RulesEngineTask=RulesEngineJob, Status=Stopped host = myhost = _internalsource = /opt/splunk/var/log/splunk/itsi_rules_engine.log sourcetype = itsi_internal_log 2022-09-26 12:38:02,902 DEBUG [itsi_re(reId=cRdG)] [main] PropertyLoader:209 - itsiRulesEngine.localConfigurationFile properties file is not defined. host = myhost = _internalsource = /opt/splunk/var/log/splunk/itsi_rules_engine.log sourcetype = itsi_internal_log All the SH are on the same lan/network, no firewall. The ERROR [itsi_re(reId=yVNs)] [main] RulesEngineSearch:75 - RulesEngineTask=RealTimeSearch, Status=Stopped, FunctionMessage="java.lang.NoSuchMethodError: 'com.fasterxml.jackson.core.util.JacksonFeatureSet com.fasterxml.jackson.core.JsonParser.getReadCapabilities()'" is logged every minute. ... View more

Re: Aggregation Policies email alert action: how t...

by Splunk Employee in Splunk IT Service Intelligence
‎09-23-2022 12:18 AM
‎09-23-2022 12:18 AM
The footer is always set on "HTML & Plain Text" type,  Please select the option "Plain Text" type and check if the footer is removed. Here in the step 7 for the Send an email. https://docs.splunk.com/Documentation/ITSI/latest/EA/Actions#Send_an_email   ... View more

Aggregation Policies email alert action: how to re...

by Splunk Employee in Splunk IT Service Intelligence
‎09-23-2022 12:15 AM
‎09-23-2022 12:15 AM
In ITSI, when triggering the email alert action via NEAP, Splunk ITSI always add a footer text to the mail body. We remove the footer text in the email alert action config gui and press save, but when we open the config again then Splunk has added the footer again. There is no footer added in the general mail setting in Splunk. ... View more

Re: How to suppress Notable Events in ITSI?

by Splunk Employee in Splunk IT Service Intelligence
‎08-23-2022 07:38 AM
‎08-23-2022 07:38 AM
How to suppress the notable events in Splunk itsi ? Configuration > Correlation Searches > Open the Correlation Search > Advanced Options For more information: https://docs.splunk.com/Documentation/ITSI/4.14.0/EA/ConfigCS#Advanced_Options And when an episode breaks will the related notable events gets cleared?  No, the notables are not cleared. What happens is: a new episode is created, and the new notables are going to this new episode. So the notables that came before this "break" are kept in the previous episode. https://docs.splunk.com/Documentation/ITSI/4.14.0/EA/FilteringCriteria#Break_episode when an new episode gets created the related notable events count will be a fresh count from the time of episode creation or it will be a accumulated from the previous count.  It will be a fresh count from the time of the episode creation.     ... View more

Re: Service template unlinking option needs to be ...

by Splunk Employee in Splunk IT Service Intelligence
‎02-19-2021 10:51 AM
‎02-19-2021 10:51 AM
Hi @luminadsouza13 , that's correct, so far, there is no direct way to unlink them. At least, per the ITSI 4.7.1 documentation, here are the options that we have.  There's no direct method to unlink a service from a template. You can only unlink a service by performing one of the following actions: Deleting the service template Linking the service to a different service template Modifying the name of a linked KPI Modifying the base search of a linked KPI Modifying any settings in the KPI Search and Calculate section, including enabling backfill Deleting a KPI that's linked to the template https://docs.splunk.com/Documentation/ITSI/4.7.1/SI/LinkST#Unlink_a_service_from_a_template You might want to submit this enhancement request via Splunk Ideas. Splunk Ideas replaces the need to log a P4 enhancement request ticket with Splunk Support   ... View more

Re: How to calculate response time from haproxy lo...

by Splunk Employee in Splunk IT Service Intelligence
‎02-15-2021 11:14 AM
‎02-15-2021 11:14 AM
I know it is not ideal (the regex is considering the 200 status code and it is hardcoded), but just to ilustrate: | makeresults | eval _raw = "Feb 15 12:19:49 localhost haproxy[7046]: XX.XX.XXX.X:41534 [15/Feb/2021:12:19:49.989] xyz rest_service/rest-hostname-port 0/0/0/6/6 200 5715 - - --VN 73/73/7/0/0 0/0 \"GET /filterservices/xx/sadfsfsd HTTP/1.1" | rex "200\s+(?<myresponsetime>[\d]+)" | timechart span=1m avg(myresponsetime) ... View more

Re: Export episodes from ITSI to CSV

by Splunk Employee in Splunk IT Service Intelligence
‎02-15-2021 03:06 AM
1 Karma
‎02-15-2021 03:06 AM
1 Karma
you can start by checking out the itsi_grouped_alerts. This is the index for episodes.  If you want to check the notables, go to itsi_tracked_alerts. If you want to get the information that you see in the Episode Review, you might want to use the itsi_grouped_alerts index=itsi_grouped_alerts sourcetype="itsi_notable:group" | table itsi_group_id itsi_group_title itsi_group_description owner itsi_group_count This is a starting point, you can go further and adding more fields as you like.  ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎02-24-2023 10:27 AM
Karma from
View All