In ITSI, when using NEAP to trigger email alerts, Splunk ITSI automatically appends a footer text to the email body. Even though we remove the footer text via the email alert action configuration and saved successfully, it reappears when the configuration is reopened. This issue persists despite the general email settings in Splunk not containing any footer text. We also need to have the "HTML & Plain Text" on because we are running tokens and multiple links (service analyzer and viewing the episode) and if not, it will not be utilized correctly. We cannot use just the "Plain Text" due to that reason above. If anyone has any ideas or suggestions that will be much appreciated. ... View more

Currently, we receive a single email alert via Notable Event Aggregation Policies (NEAP) whenever our ITSI services transition from normal to high or critical. However, we need an automated process that sends recurring email alerts every 5 minutes if the service remains degraded and hasn't reverted back to normal. From my research, many forums and documentation suggest achieving this through Correlation Searches. However, since we rely on KPI alerting, and none of our Correlation Searches (even the out-of-the-box ones) seem to function properly, this approach hasn't worked for us... Given the critical nature of the services we monitor, we’re seeking guidance on setting up recurring alerts using NEAPs or any other reliable method within Splunk ITSI. Any assistance or insights on how to configure this would be greatly appreciated. ... View more

I've read through some of the Splunk documentation and previously one of my colleagues already configured the "Windows server health" content pack, but when I check the "OS:Performance.WIN.Memory" I only see 4 metrics and cannot get the overall % memory utilization because I do not have the total amount to begin with. These are the only metrics I have: Available_MBytes Cache_Bytes Page_Reads/sec Install and configure the Content Pack for Monitoring Microsoft Windows - Splunk Documentation ... View more

ITSI for Alert $result.service_name$ on host $result.src$ $result.description$ An event has been detected: Host: $result.host$ Source: $result.source$ Error Code: $result.error_code$ Description: $result.description$ I'm fairly new to ITSI and Splunk in general and I couldn't find out any information on tokens that clearly. The only token that is working right now is $result.description$,. Any assistance will be much appreciated.    Thank you   ... View more