Splunk documentation has a page that guides customers to troubleshoot similiar issues as you described, like when they don't find the data/events.   "Are you searching for events and not finding them, or looking at a dashboard and seeing "No result data"? Here are a few common mistakes to check." https://docs.splunk.com/Documentation/Splunk/9.1.2/Troubleshooting/Cantfinddata     ... View more

If you have already deployed the CP into services/kpis/correlation searches, neaps, etc, it means they would be existing objects into your ITSI. You can take a ITSI Backup from this environment and restore into another deployment (like cloud for example) and check the objects there. Just make sure to adjust the inputs and make sure the lookups and indexes would be there too ... View more

You might want to use the outputcsv command.  Like this: | inputlookup itsi_entities_lookup | eval alias=coalesce(title, "N/A") | fields title, alias, fields, service | outputcsv itsi_entities_export.csv ... View more

In Splunk IT Service Intelligence (ITSI), you can import entities via CSV to Entity Management using the following steps: Prepare Your CSV File: Make sure your CSV file contains the necessary information for each entity, such as title, identifier, and any other relevant fields. The CSV file should have a header row with column names. Access Entity Management: Log in to your Splunk instance and navigate to ITSI. In the ITSI main menu, go to Configure > Entity Management. Open Import Wizard: Click on Import Entities. Select CSV File: Click on Browse or similar, depending on your system, to locate and select your CSV file. Map Fields: ITSI will attempt to automatically map fields from your CSV file to ITSI entity fields. Review the mapping to ensure accuracy. If needed, manually map fields by dragging the appropriate CSV columns to the corresponding ITSI fields. Preview and Validate: Preview the entities to ensure they are correctly mapped and that the data looks accurate. Validate the data to check for any errors or missing information. Complete the Import: If everything looks correct, proceed with the import by clicking Finish or a similar button. Splunk ITSI will process the CSV file and import the entities into Entity Management. Verify Import: After the import is complete, verify that the entities are visible in the Entity Management interface. It's important to note that the exact steps and options might vary slightly depending on the version of Splunk ITSI you are using. Always refer to the official Splunk documentation for your specific version for the most accurate and up-to-date information. For more information: https://docs.splunk.com/Documentation/ITSI/latest/Entity/ImportCSV#Steps ... View more

you can use UI or kvstore_to_json script to do it.  https://docs.splunk.com/Documentation/ITSI/4.16.0/Configure/BackupandRestoreITSIconfig You can go to Splunk > ITSI > Configuration > Backup/Restore and upload the backup taken from the source environment and restore the ITSI objects.  If you decides to use kvstore_to_json method, you will need to go to the host (via terminal) and run the commands manually https://docs.splunk.com/Documentation/ITSI/4.16.0/Configure/kvstorejson   ... View more

I think you can limit the hosts in the Action Rules, something like that AND the number of events on the episode = 1 then trigger the create servicenow incident     ... View more

How to suppress the notable events in Splunk itsi ? Configuration > Correlation Searches > Open the Correlation Search > Advanced Options For more information: https://docs.splunk.com/Documentation/ITSI/4.14.0/EA/ConfigCS#Advanced_Options And when an episode breaks will the related notable events gets cleared?  No, the notables are not cleared. What happens is: a new episode is created, and the new notables are going to this new episode. So the notables that came before this "break" are kept in the previous episode. https://docs.splunk.com/Documentation/ITSI/4.14.0/EA/FilteringCriteria#Break_episode when an new episode gets created the related notable events count will be a fresh count from the time of episode creation or it will be a accumulated from the previous count.  It will be a fresh count from the time of the episode creation.     ... View more

Hi @luminadsouza13 , that's correct, so far, there is no direct way to unlink them. At least, per the ITSI 4.7.1 documentation, here are the options that we have.  There's no direct method to unlink a service from a template. You can only unlink a service by performing one of the following actions: Deleting the service template Linking the service to a different service template Modifying the name of a linked KPI Modifying the base search of a linked KPI Modifying any settings in the KPI Search and Calculate section, including enabling backfill Deleting a KPI that's linked to the template https://docs.splunk.com/Documentation/ITSI/4.7.1/SI/LinkST#Unlink_a_service_from_a_template You might want to submit this enhancement request via Splunk Ideas. Splunk Ideas replaces the need to log a P4 enhancement request ticket with Splunk Support   ... View more

I know it is not ideal (the regex is considering the 200 status code and it is hardcoded), but just to ilustrate: | makeresults | eval _raw = "Feb 15 12:19:49 localhost haproxy[7046]: XX.XX.XXX.X:41534 [15/Feb/2021:12:19:49.989] xyz rest_service/rest-hostname-port 0/0/0/6/6 200 5715 - - --VN 73/73/7/0/0 0/0 \"GET /filterservices/xx/sadfsfsd HTTP/1.1" | rex "200\s+(?<myresponsetime>[\d]+)" | timechart span=1m avg(myresponsetime) ... View more

you can start by checking out the itsi_grouped_alerts. This is the index for episodes.  If you want to check the notables, go to itsi_tracked_alerts. If you want to get the information that you see in the Episode Review, you might want to use the itsi_grouped_alerts index=itsi_grouped_alerts sourcetype="itsi_notable:group" | table itsi_group_id itsi_group_title itsi_group_description owner itsi_group_count This is a starting point, you can go further and adding more fields as you like.  ... View more