Splunk ITSI

Episode page is not loading any data in ITSI app version 4.0.3

mbagali_splunk
Splunk Employee
Splunk Employee

Episode page is not loading any data in ITSI app version 4.0.3, We see below errors:

JSON parsing of _raw field= failed with the following error, so skipping event:

JSON parsing of _raw field=$xxxxxxxxxxx$;$itsi_tracked_alerts$ failed with the following error, so skipping event:

0 Karma
1 Solution

mbagali_splunk
Splunk Employee
Splunk Employee

This is a expected behavior when the events details and fields are very long.

This has been noted and published as known issue in https://docs.splunk.com/Documentation/ITSI/4.0.2/ReleaseNotes/Knownissues .

Correlation/Notable events fields have no length safeguard, and can be exceed the default splunk limits for parsing (truncate or json parsing), causing those events to be unusable.

The work around would be:

Workaround:
Keep the events fields smaller, by changing the correlation searches.
Or Optimize the sourcetypes in ITSI, to raise the truncate limits for them to match the limit used for the regex (100000 at least) And provide warnings to tell the customer that the issue is happening, and link to the docs to fix

example of props

[itsi_notable:event]
KV_MODE = none
INDEXED_EXTRACTIONS = JSON
TRUNCATE=100000

[itsi_notable:group]
KV_MODE = none
INDEXED_EXTRACTIONS = JSON
TRUNCATE=100000

View solution in original post

mbagali_splunk
Splunk Employee
Splunk Employee

This is a expected behavior when the events details and fields are very long.

This has been noted and published as known issue in https://docs.splunk.com/Documentation/ITSI/4.0.2/ReleaseNotes/Knownissues .

Correlation/Notable events fields have no length safeguard, and can be exceed the default splunk limits for parsing (truncate or json parsing), causing those events to be unusable.

The work around would be:

Workaround:
Keep the events fields smaller, by changing the correlation searches.
Or Optimize the sourcetypes in ITSI, to raise the truncate limits for them to match the limit used for the regex (100000 at least) And provide warnings to tell the customer that the issue is happening, and link to the docs to fix

example of props

[itsi_notable:event]
KV_MODE = none
INDEXED_EXTRACTIONS = JSON
TRUNCATE=100000

[itsi_notable:group]
KV_MODE = none
INDEXED_EXTRACTIONS = JSON
TRUNCATE=100000

Get Updates on the Splunk Community!

Cloud Platform | Customer Change Announcement: Email Notification Will Be Available ...

The Notification Team is migrating our email service provider since currently there’s no support ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...