Known issues in Splunk IT Service Intelligence

This version of IT Service Intelligence (ITSI) has the following known issues and workarounds.

Adaptive Thresholding

Date filed	Issue number	Description
2023-06-16	ITSI-31029	Threshold config colors not updating unless changes are saved
2023-04-26	ITSI-29672	KPI preview fails to render sometimes Workaround: NA
2023-03-21	ITSI-29200	Change in the threshold value of a KPI in a service template does not update in the services linked to it. Workaround: In the threshold editor, create a new temporary time policy, save, and select *Replace all KPI thresholds.* This will force the propagation of all time policies to all linked services. After this occurs, you can also delete the extra policy.
2023-01-03	ITSI-27867	In Adaptive Thresholding Clicking on apply button shows any warning as errors in UI.

Entities

Date filed	Issue number	Description
2023-08-14	ITSI-31723	Error modal appears when user attempts to filter entities with a parenthesis in the name on entity management page Workaround: Use backslash before the special character. To search for "myhost(" try "myhost\("

Notable Events

Date filed	Issue number	Description
2023-06-29	ITSI-31192	All Events tab does not render default columns if they are not present in NEAP JSON definition Workaround: # Use the latest ITSI Backup file to edit the NEAP JSON definition and remove the property Template:All events columns and restore the backup. Go to Episode Review page and add back all the desired columns

Glass Table

Date filed	Issue number	Description
2023-04-11	ITSI-29450	variable should be pass between different widgets in glass table
2022-12-21	ITSI-27763	Assigning an ad-hoc search as a datasource to the empty viz, breaks the entire glass table page
2022-12-20	ITSI-27743	Drilldown and URL link in Glass Table may open double tabs/windows

Performance

Date filed	Issue number	Description
2023-04-26	ITSI-29672	KPI preview fails to render sometimes Workaround: NA

Role Based Access Controls

Date filed	Issue number	Description
2023-05-04	ITSI-30017	A user in itoa_user role cannot open ITSI homeview in SHC. Workaround: We have to add the list_search_head_clustering capability to the default authorize.conf.

Service Analyzer

Date filed	Issue number	Description
2023-06-09	ITSI-30822	ITSI degraded-entities-search-manager may have caused indexers cluster to crash Workaround: If Service Analyser is running for more than 1 week's time range and search is going through millions of events try to limit the service analyser time range to less than 1 week to limit the search time range.
2023-06-07	ITSI-30580	When the dbconnect app is installed, non-admin ITSI users cannot access their homepage but are routed to the upgrade page. Workaround: Add the db_connect_read_app_conf capability to the custom user with a non-admin role. Enable this capability in the default authorize.conf file.
2023-02-17	ITSI-28826	Changes to health score color values in threshold_labels.conf do not appear in the service analyzer.

Service Definition

Date filed	Issue number	Description
2023-05-29	ITSI-30378	Time policy auto-shifts by one hour upon user addition Workaround: Shifts time block by using kvstore_to_json.py script mode 3

Service Health Score

Date filed	Issue number	Description
2022-09-28	ITSI-26376	Large number of KPI caused the service_health_metrics_monitor sub search to hit the 50000 default limit, causing discrepancies in values in Service Health Score alert_level in itsi_summary_metrics versus itsi_summary indexes. Workaround: Increase the limits.conf to adjust to the total number of KPIs in the subsearch of service_health_metrics_monitor. See example for a customer with 50000-70000 KPI objects. {{[join] }} Template:Subsearch maxout = 75000 {{#default was 50000 }} {{[searchresults] }} Template:Maxresultrows = 75000 {{ # default was 50000}}

Service Templates

Date filed	Issue number	Description
2023-03-21	ITSI-29200	Change in the threshold value of a KPI in a service template does not update in the services linked to it. Workaround: In the threshold editor, create a new temporary time policy, save, and select *Replace all KPI thresholds.* This will force the propagation of all time policies to all linked services. After this occurs, you can also delete the extra policy.

Uncategorized issues

Date filed	Issue number	Description
2024-01-23	ITSI-34041	ITSI Episode view triggers a search to populate linked tickets, that is looking back to epoch time=1 second till now
2023-09-05	ITSI-31978	Correlation search edit page malfunctions when time range set to "All Time" Workaround: *Workaround 1* From Setting-->Searches, Reports, and Alerts-->search for CS-->Edit Alert-->Update time range to Template:Last 15 Minutes from Template:All Time Workaround 2* Update/add itsi/local/savedsearches.conf as following: {noformat}dispatch.earliest_time = 0 dispatch.latest_time = now{noformat}
2023-08-02	ITSI-31555, ITSI-31464	the ITSI integration create SNOW tickets with SPL instead of INC prefix when using Episode Action with custom endpoints with ServiceNow_TA version 7.6.0 Workaround: Until bug in service now ADDON 7.6 bug (ADDON-64098 & ADDON-63502 ) are resolved, to avoid the issue, in ITSI, do not specify a custom endpoint in the action setup, keep the field empty.
2023-05-11	ITSI-30095	Change all non-macro based OOTB references to ITSI indexes to use macros
2023-05-10	ITSI-30068	Event Analytics Monitoring Rules Engine Information panel uses an All time search Workaround: Edit the Event Analytics Monitoring Dashboard. Click on the magnifying glass under the Rules Engine Information panel. Change the Time Range to Shared Time Picker (time_token).
2023-03-20	ITSI-29133	Episode Review dashboard panel for Noise reduction should not show "Missing property: majorValue"
2022-12-20	ITSI-27741	When closing episodes in bulk, episodes with different statuses display as closed but aren't actually closed. Workaround: During the bulk update of the episodes from the UI, make sure that all the Episodes selected for the bulk update at a time have same Status.
2021-09-01	ITSI-18709	ITSI redirects to suite_redirect 500 Internal Server Error - because of python library isolation between apps Workaround: Step 1: Identify all the splunklib directories within the splunk apps directory using command find . -name 'splunklib' | xargs -r ls -lah. Step 2: For each directory listed in step 1, check if file six.py is present. Step 3: Copy the six.py from an existing splunklib directory into all the missing directories. Step 4: Clean the cached files using find . -name "*.pyc" -delete Step 5: Restart Splunk on the ITE Work or ITSI search head.