Episode page is not loading any data in ITSI app version 4.0.3

[mbagali_splunk]

Episode page is not loading any data in ITSI app version 4.0.3, We see below errors:

JSON parsing of _raw field= failed with the following error, so skipping event:

JSON parsing of _raw field=$xxxxxxxxxxx$;$itsi_tracked_alerts$ failed with the following error, so skipping event:

[mbagali_splunk · Accepted solution]

This is a expected behavior when the events details and fields are very long.

This has been noted and published as known issue in https://docs.splunk.com/Documentation/ITSI/4.0.2/ReleaseNotes/Knownissues .

Correlation/Notable events fields have no length safeguard, and can be exceed the default splunk limits for parsing (truncate or json parsing), causing those events to be unusable.

The work around would be:

Workaround:
Keep the events fields smaller, by changing the correlation searches.
Or Optimize the sourcetypes in ITSI, to raise the truncate limits for them to match the limit used for the regex (100000 at least) And provide warnings to tell the customer that the issue is happening, and link to the docs to fix

example of props

[itsi_notable:event]
KV_MODE = none
INDEXED_EXTRACTIONS = JSON
TRUNCATE=100000

[itsi_notable:group]
KV_MODE = none
INDEXED_EXTRACTIONS = JSON
TRUNCATE=100000