Splunk ITSI

ITSI Episodes Data Inconsistent

krunoslav
Engager

Hello,

When fetching the episodes from ITSI via REST (https://hostname:8089/servicesNS/fsspl06/itsi/event_management_interface/notable_event_group?filter={"status":"1","severity":{"$gte":"3"}}) a list of several episodes with status "New" is obtained. However, in the ITSI GUI, in the Episode Review tab, a search for all new episodes over all time returns no results. How is this possible? Any clues on how to debug this? Thanks

Labels (2)
Tags (2)
0 Karma

eduncan
Splunk Employee
Splunk Employee

If you are sure that even in the itsi_summary index that the groupid's for the ones retrieved via rest are NOT there, then I'd open a support case.

0 Karma

eduncan
Splunk Employee
Splunk Employee

Need more info on your filter.  What is set for Status Filter and Severity Filter?

0 Karma

krunoslav
Engager

In ITSI GUI the Status is set to New and the severity is not set

0 Karma

eduncan
Splunk Employee
Splunk Employee

Also if you search the. index=itsi_grouped_alerts do you see the groupID of the same episodes you got from the REST API?

 

0 Karma

krunoslav
Engager

No, the episodes returned via REST are not found in the index.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...