Hi @luminadsouza13 , that's correct, so far, there is no direct way to unlink them. At least, per the ITSI 4.7.1 documentation, here are the options that we have.  There's no direct method to unlink a service from a template. You can only unlink a service by performing one of the following actions: Deleting the service template Linking the service to a different service template Modifying the name of a linked KPI Modifying the base search of a linked KPI Modifying any settings in the KPI Search and Calculate section, including enabling backfill Deleting a KPI that's linked to the template https://docs.splunk.com/Documentation/ITSI/4.7.1/SI/LinkST#Unlink_a_service_from_a_template You might want to submit this enhancement request via Splunk Ideas.  Splunk Ideas replaces the need to log a P4 enhancement request ticket with Splunk Support   ... View more

I know it is not ideal (the regex is considering the 200 status code and it is hardcoded), but just to ilustrate: | makeresults | eval _raw = "Feb 15 12:19:49 localhost haproxy[7046]: XX.XX.XXX.X:41534 [15/Feb/2021:12:19:49.989] xyz rest_service/rest-hostname-port 0/0/0/6/6 200 5715 - - --VN 73/73/7/0/0 0/0 \"GET /filterservices/xx/sadfsfsd HTTP/1.1" | rex "200\s+(?<myresponsetime>[\d]+)" | timechart span=1m avg(myresponsetime) ... View more

you can start by checking out the itsi_grouped_alerts. This is the index for episodes.  If you want to check the notables, go to itsi_tracked_alerts. If you want to get the information that you see in the Episode Review, you might want to use the itsi_grouped_alerts index=itsi_grouped_alerts sourcetype="itsi_notable:group" | table itsi_group_id itsi_group_title itsi_group_description owner itsi_group_count This is a starting point, you can go further and adding more fields as you like.  ... View more