About taskar

taskar · ‎06-28-2021

Hi, I have made a an app that generate an lookup csv-file. The saved search are running good, file generated in lookups-folder. lookup table file made global. Lookup definition is made global, and the automatic lookup is also made global in the app. All config are saved in the default folder and pushed out with our SH deployer. When enabling the automatic lookup for my source in props.conf I get an error when searching: "Could Not Load lookup" from my indexer peers. If i do the exact same thing in the web UI, config then saved in "local" - I do not see the same errror. When doing manual lookup in SPL "| lookup gamecatalog_lookup id as NtGameId OUTPUTNEW name status vendor gameStudio" - results in error "Streamed search execute failed because: Error in 'lookup' command: Could not construct lookup" But when I do the sam search and add local=true the search finishes just fine and to the extraction. What am I missing? I should be able to push automatic lookups with my own app? all permissions and sharing are global and everyone has read.

taskar · ‎09-09-2020

We are running on the same version as you. We just did a workaround on the correlation search in ITSI SH cluster to extract the needed kv-pair | extract pairdelim=",", kvdelim="=", auto=f, limit=200, mv_add=t

taskar · ‎08-13-2020

It was an issue with field exctractions. Did not extract the field sys_updated_on from the servicenow event. Fixed that and then I ran the correlation search to build the csv.

taskar · ‎06-29-2020

We are trying to run bidirectional ticketing (ServiceNow) and are experiencing some issues. ITSI v4.3.3, datamodel are working just find far as I know. The correlation search uses snow_hash.csv as input and ouput. But the file are missing, anyone with a quickfix? Should I just manually create it? Anyone know when it is created? Error message from job output when running the correlation search manually: [subsearch]: File '/opt/splunk/var/run/splunk/csv/snow_hash.csv' could not be opened for reading.

taskar · ‎05-21-2020

It was acctually some old searches defined on our deployer. They had the wrong number of inputs. Removed those and pushed new boundle. case closed 🙂

taskar · ‎05-21-2020

Resolved. It was acctually some old searches defined on our deployer. Removed those and pushed new boundle. case closed 🙂

taskar · ‎05-12-2020

The event are followed by an event like: 05-12-2020 12:56:01.520 +0200 ERROR SHCRepJob - failed job=SHPDelegateSearchJob peer="myhostname.fake.splunk.no", guid="E3E36E38-52DC-4F32-83CD-498681B3A8B3" saved_search=system;; err=uri=https://172.20.242.50:8089/servicesNS/nobody/itsi/shcluster/member/delegatejob/Indicator%20-%204eb622b34ca077dce08e9245%20-%20ITSI%20Search/sched_dispatch?output_mode=json, error=500 - \n In handler 'shclustermemberdelegatejob': Error in 'SearchParser': The search specifies a macro 'assess_severity' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.

taskar · ‎05-12-2020

hi, I'm finding lot of these errors in my ITSI cluster (4.4.1/7.3.3) index=_internal 05-12-2020 12:56:01.520 +0200 ERROR SearchParser - The search specifies a macro 'assess_severity' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information. I find 4 macros in the app SA-ITOA, all having 1 to 6 different arguments required. Sharing is Global, everyone have read permissions. Anyone with an answere or suggestion on what to do?

taskar · ‎01-16-2019

thanks for your reply. I've tried what you suggest - dont work any better. A workaround is to use Alerts instead of the ServiceNow integration in ITSI. Then tokens are working as expected. Rumors as it that a new integration with servicenow is coming Q1 2019. Fingers crossed

taskar · ‎10-26-2018

Splunk_TA_snow/local/local/alert_actions.conf is the config file for populating the fields. But havent found any way to use use token variables such as %orig_description%, %orig_owner%, %orig_severity%, %orig_status%, and so on.

taskar · ‎10-04-2018

We are running ITSI 3.1.4. Look like we are running into the same problem. 160 services are synced with the same service template. I have a response time KPI I want to edit the threshold template for. Static template are no problem syncing. But I want to use one of my adaptive template. Seems to me that I manually need to “apply adaptive threshold” for every Service. I haven't tried to wait over night, and will try that. But there shuld be a way to force update.

taskar · ‎06-07-2018

Hi, I have installed and configured the Add-on for ServiceNow. Integration with notable events are working, incidents are created in Service Now. But I would like to have the fields auto populated from the notable event. See screenshot. Is it possible to have a two-way communication? close the Notable Event when ServiceNow ticket is closed i.e. Any tip?

taskar · ‎04-26-2018

i can see my wishes for a service template has arrived yesterday in ITSI 3.1.0. Problem solved 😉

taskar · ‎04-05-2018

Is it possible to add the same KPI to multiple Services at the same time? In example using API's to add/clone a KPI to several Services (Trying not to click my way trough hundreds of services) Any ideas?

Posts	14
Solutions	4
Karma Given	0
Karma Received	2
Member Since	‎03-10-2017

Online Status	Offline
Date Last Visited	‎06-30-2021 02:46 AM

Automatic lookup - SH cluster

Splunk ITSI bidirectional ticketing - ServiceNow -...

Splunk ITSI - The search specifies a macro 'assess...

Splunk ITSI and ServiceNow - Auto populate fields

Splunk ITSI - How to add the same KPI to multiple ...

Automatic lookup - SH cluster

Re: Splunk ITSI bidirectional ticketing - ServiceN...

Re: Splunk ITSI bidirectional ticketing - ServiceN...

Splunk ITSI bidirectional ticketing - ServiceNow -...

Re: Splunk ITSI - The search specifies a macro 'as...

Re: Splunk ITSI - The search specifies a macro 'as...

Re: Splunk ITSI - The search specifies a macro 'as...

Splunk ITSI - The search specifies a macro 'assess...

Re: Splunk ITSI and ServiceNow - Auto populate fie...

Re: Splunk ITSI and ServiceNow - Auto populate fie...

Re: Force to run adaptive thresholding update in I...

Splunk ITSI and ServiceNow - Auto populate fields

Re: Splunk ITSI - How to add the same KPI to multi...

Splunk ITSI - How to add the same KPI to multiple ...