Splunk IT Service Intelligence

Episode page is not loading any data in ITSI app version 4.0.3

mbagali_splunk
Splunk Employee
Splunk Employee

Episode page is not loading any data in ITSI app version 4.0.3, We see below errors:

JSON parsing of _raw field= failed with the following error, so skipping event:

JSON parsing of _raw field=$xxxxxxxxxxx$;$itsi_tracked_alerts$ failed with the following error, so skipping event:

0 Karma
1 Solution

mbagali_splunk
Splunk Employee
Splunk Employee

This is a expected behavior when the events details and fields are very long.

This has been noted and published as known issue in https://docs.splunk.com/Documentation/ITSI/4.0.2/ReleaseNotes/Knownissues .

Correlation/Notable events fields have no length safeguard, and can be exceed the default splunk limits for parsing (truncate or json parsing), causing those events to be unusable.

The work around would be:

Workaround:
Keep the events fields smaller, by changing the correlation searches.
Or Optimize the sourcetypes in ITSI, to raise the truncate limits for them to match the limit used for the regex (100000 at least) And provide warnings to tell the customer that the issue is happening, and link to the docs to fix

example of props

[itsi_notable:event]
KV_MODE = none
INDEXED_EXTRACTIONS = JSON
TRUNCATE=100000

[itsi_notable:group]
KV_MODE = none
INDEXED_EXTRACTIONS = JSON
TRUNCATE=100000

View solution in original post

mbagali_splunk
Splunk Employee
Splunk Employee

This is a expected behavior when the events details and fields are very long.

This has been noted and published as known issue in https://docs.splunk.com/Documentation/ITSI/4.0.2/ReleaseNotes/Knownissues .

Correlation/Notable events fields have no length safeguard, and can be exceed the default splunk limits for parsing (truncate or json parsing), causing those events to be unusable.

The work around would be:

Workaround:
Keep the events fields smaller, by changing the correlation searches.
Or Optimize the sourcetypes in ITSI, to raise the truncate limits for them to match the limit used for the regex (100000 at least) And provide warnings to tell the customer that the issue is happening, and link to the docs to fix

example of props

[itsi_notable:event]
KV_MODE = none
INDEXED_EXTRACTIONS = JSON
TRUNCATE=100000

[itsi_notable:group]
KV_MODE = none
INDEXED_EXTRACTIONS = JSON
TRUNCATE=100000

*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>