Splunk IT Service Intelligence

ITSI Episodes Data Inconsistent

krunoslav
Engager

Hello,

When fetching the episodes from ITSI via REST (https://hostname:8089/servicesNS/fsspl06/itsi/event_management_interface/notable_event_group?filter={"status":"1","severity":{"$gte":"3"}}) a list of several episodes with status "New" is obtained. However, in the ITSI GUI, in the Episode Review tab, a search for all new episodes over all time returns no results. How is this possible? Any clues on how to debug this? Thanks

Labels (2)
Tags (2)
0 Karma

eduncan
Splunk Employee
Splunk Employee

If you are sure that even in the itsi_summary index that the groupid's for the ones retrieved via rest are NOT there, then I'd open a support case.

0 Karma

eduncan
Splunk Employee
Splunk Employee

Need more info on your filter.  What is set for Status Filter and Severity Filter?

0 Karma

krunoslav
Engager

In ITSI GUI the Status is set to New and the severity is not set

0 Karma

eduncan
Splunk Employee
Splunk Employee

Also if you search the. index=itsi_grouped_alerts do you see the groupID of the same episodes you got from the REST API?

 

0 Karma

krunoslav
Engager

No, the episodes returned via REST are not found in the index.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...