Splunk ITSI

Episode page is not loading any data in ITSI app version 4.0.3

mbagali_splunk
Splunk Employee
Splunk Employee

Episode page is not loading any data in ITSI app version 4.0.3, We see below errors:

JSON parsing of _raw field= failed with the following error, so skipping event:

JSON parsing of _raw field=$xxxxxxxxxxx$;$itsi_tracked_alerts$ failed with the following error, so skipping event:

0 Karma
1 Solution

mbagali_splunk
Splunk Employee
Splunk Employee

This is a expected behavior when the events details and fields are very long.

This has been noted and published as known issue in https://docs.splunk.com/Documentation/ITSI/4.0.2/ReleaseNotes/Knownissues .

Correlation/Notable events fields have no length safeguard, and can be exceed the default splunk limits for parsing (truncate or json parsing), causing those events to be unusable.

The work around would be:

Workaround:
Keep the events fields smaller, by changing the correlation searches.
Or Optimize the sourcetypes in ITSI, to raise the truncate limits for them to match the limit used for the regex (100000 at least) And provide warnings to tell the customer that the issue is happening, and link to the docs to fix

example of props

[itsi_notable:event]
KV_MODE = none
INDEXED_EXTRACTIONS = JSON
TRUNCATE=100000

[itsi_notable:group]
KV_MODE = none
INDEXED_EXTRACTIONS = JSON
TRUNCATE=100000

View solution in original post

mbagali_splunk
Splunk Employee
Splunk Employee

This is a expected behavior when the events details and fields are very long.

This has been noted and published as known issue in https://docs.splunk.com/Documentation/ITSI/4.0.2/ReleaseNotes/Knownissues .

Correlation/Notable events fields have no length safeguard, and can be exceed the default splunk limits for parsing (truncate or json parsing), causing those events to be unusable.

The work around would be:

Workaround:
Keep the events fields smaller, by changing the correlation searches.
Or Optimize the sourcetypes in ITSI, to raise the truncate limits for them to match the limit used for the regex (100000 at least) And provide warnings to tell the customer that the issue is happening, and link to the docs to fix

example of props

[itsi_notable:event]
KV_MODE = none
INDEXED_EXTRACTIONS = JSON
TRUNCATE=100000

[itsi_notable:group]
KV_MODE = none
INDEXED_EXTRACTIONS = JSON
TRUNCATE=100000

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...