Splunk ITSI

Export episodes from ITSI to CSV

mathtronix
New Member

Hello SPLUNK Community!

I need to do some Excel analysis on the Episodes in ITSI, breaking them up by various parameters. I might be able to create a SPLUNK dashboard to do this sort of thing, but I think management is going to want it in Excel ultimately.

Making a report off of raw searches is a cake walk, but is there any way to make a report of the EPISODES in ITSI? Basically what I am doing now is literally highlighting and copying the episodes off our ITSI Episode Review and pasting them into excel, getting me all the data from the columns like assignee, time/date, etc. I know there is a way to do this more programmatically

Or am I barking up the wrong tree here? Do I need to generate reports for each correlation search instead?

Thanks in advance!

Labels (1)
0 Karma

lperini_splunk
Splunk Employee
Splunk Employee

you can start by checking out the itsi_grouped_alerts. This is the index for episodes. 
If you want to check the notables, go to itsi_tracked_alerts.

If you want to get the information that you see in the Episode Review, you might want to use the itsi_grouped_alerts

index=itsi_grouped_alerts sourcetype="itsi_notable:group"
| table itsi_group_id itsi_group_title itsi_group_description owner itsi_group_count

This is a starting point, you can go further and adding more fields as you like. 

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...