Known issues in Splunk IT Service Intelligence

This version of IT Service Intelligence (ITSI) has the following known issues and workarounds.

Notable Events

Date filed	Issue number	Description
2025-06-26	ITSI-40536	NATS Configuration Not Updating with SHC Membership Changes Workaround: *Known Issue to be document: Search Head Cluster (SHC) Membership Changes Do Not Update* Template:Nats-js.conf *Routes Automatically* When a Search Head (SH) is removed from a Search Head Cluster (SHC), the Template:$SPLUNK HOME/etc/apps/SA-ITOA/bin/nats/nats-js.conf file is not automatically updated to reflect this change in the NATS route configuration. Steps to Reproduce:* Remove a Search Head from the cluster using Template:Splunk remove shcluster-member. Stop Splunk on the removed Search Head (Template:Splunk stop). Perform a rolling restart of the remaining Search Heads. The removed Search Head no longer appears in the Search Head Clustering view. However, the entry for the removed Search Head remains in the Template:Nats-js.conf file under the Template:Routes section. Current Behavior:* The NATS server is designed to auto-discover new Search Heads but does not automatically remove entries for Search Heads that have been removed from the cluster. As a result, stale route entries may persist in the Template:Nats-js.conf file. Workaround:* Manually edit the Template:Nats-js.conf file on all Search Heads to remove the route entry for the removed Search Head. After making this change, reload nats configuration using command {noformat}$SPLUNK_HOME/etc/apps/SA-ITOA/bin/nats$ ./nats-server --signal reload {noformat} OR restart the NATS server on each Search Head. Example:* If your Template:Nats-js.conf contains: {noformat}"routes": [ "nats://SH1:4248", "nats://SH2:4248", "nats://SH3:4248" ] {noformat} and Template:SH2 is removed from the cluster, you must manually remove the Template:"nats://SH2:4248" entry from the Template:Routes array on all Search Heads and restart the NATS server on them. Note:* Failure to update the Template:Nats-js.conf file may result in connectivity issues or errors in NATS communication within the cluster.

Glass Table

Date filed	Issue number	Description
2024-11-27	ITSI-38150	Date & Time range changes to default after saving the custom time range in glass table Workaround: # Select the desired time range in the time picker and click "Apply" (you'll see the incorrect time in the time picker). Change the time picker selection by expanding the "Advanced" section, removing the "Z" from the end of the start and end times, and clicking "Apply".
2024-08-20	ITSI-37082, ITSI-37083	Duplicate search job running while opening/reloading glass table, causing slowness. Workaround: Upgrade to fixed version (4.19.3 or 4.20.*)

Performance

Date filed	Issue number	Description
2024-07-23	ITSI-36787, ITSI-31548	App SA-ITSI-AT-Recommendations and SA-ITSI-DriftDetection failing Python3 readiness check Workaround: Check next major release for fix.

Uncategorized issues

Date filed	Issue number	Description
2025-05-14	ITSI-40076	Alerts are not being sent to PagerDuty from ITSI Episodes <ITSI 4.19.2> Workaround: fix
2025-02-21	ITSI-39178	Cannot create a new content pack and page will crash when the an environment has a large number of services.
2025-02-18	ITSI-39146	Pagination in the Comments tab should not be displayed on the side
2025-02-14	ITSI-39098	Glasstables slower to load on 4.19.2, after ITSI upgrade from 4.17
2024-12-19	ITSI-38545	Upgrade Readiness Dashboard - failing to fix "Incorrect service linked to entity" and "Dependent services missing" Workaround: Fix in coming ITSI 4.20
2024-12-13	ITSI-38442	Error for non itoa_admin users when loading the KPI base searches lister page
2024-11-12	ITSI-37977	The list of saved episodes fails to load, and displays a kvstore memory limit error.
2024-10-18	ITSI-37708	ITSI 4.19.* throwing python errors / warnings on Splunk 9.2.* "PkgResourcesDeprecationWarning: unknown is an invalid version and will not be supported in a future release"
2021-09-01	ITSI-18709	ITSI redirects to suite_redirect 500 Internal Server Error - because of python library isolation between apps Workaround: Step 1: Identify all the splunklib directories within the splunk apps directory using command find . -name 'splunklib' | xargs -r ls -lah. Step 2: For each directory listed in step 1, check if file six.py is present. Step 3: Copy the six.py from an existing splunklib directory into all the missing directories. Step 4: Clean the cached files using find . -name "*.pyc" -delete Step 5: Restart Splunk on the ITE Work or ITSI search head.
2019-05-30	ITSI-3322	If you add a correlation search in ITSI which contains a sub-search returning into an eval, you get a message "Invalid search string: This search cannot be parsed when parse_only is set to true." Workaround: You can't use a sub-search returning into an eval in a correlation search. As a workaround, create and save a basic correlation search with all of the information you want outside of the search. Then as an admin user, go to Settings > Searches, reports, and alerts and open the correlation search you just created. Add the sub-search you were trying to add there.