Splunk Enterprise

itsi episodes count updating though resolved


Hi Community ,

We have integrated our itsi cluster to servicenow and tickets are creating fine.  but recently observed a strange behavior from splunk itsi  that . episodes generated in episode review will create servicenow incident . once issue resolves episode will get resolved .


But when the same issue happens with same node  , resolved episode count gets increased , instead of creating new notable event and a new episode. itsi logs  doesnot provide much details about this , please help check why .


Best regards



Labels (2)
0 Karma


Thanks !! found a way to resolve it 🙂

0 Karma

New Member

1. Try moving the event to closed state instead of the Resolved.
2. You can even check your actions rules for the breaking of episode it should have the states mentioned to break the episode.

3. Also check if the CorrelationID it should change for new Episodes.

Tags (1)
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>