Splunk® App for Content Packs

Release Notes

This documentation does not apply to the most recent version of Splunk® App for Content Packs. For documentation on the most recent version, go to the latest release.

Known issues in the Splunk App for Content Packs

This version of the app has the following reported known issues. If no issues appear below, no issues have yet been reported.


Date filed Issue number Description
2023-04-11 ITSI-29432 Readme file is not present for the ITE Work Alert Routing Content Pack
2022-09-01 ITSI-25976 "Select Incident Priority" Dropdown of "ServiceNow - Incident Inspector" Dashboard is not working properly when we select "Equals" based filter
2022-05-24 ITSI-24343 Some Panels of Glass Table are redirecting to the parent service.
2022-05-24 ITSI-24338 Entity Overview Dashboard Issues : ITSI Timepicker is not synced with the dropdown of RUM Dashboards
2022-04-07 ITSI-22848 KPI Base Search SPLK-Indexer.FutureTime has invalid timerange (latest=+18y@y) in search query

Workaround:
Existing customers of the Content Pack can update the "SPLK-Indexer.FutureTime" KPI search to overcome the issue.

+Steps for the workaround+

  1. In IT Service Intelligence, go to *Configuration → KPI Base Searches.*
  2. Open the "SPLK-Indexer.FutureTime" KPI.
  3. Go to the search query of the KPI and replace the value of 'latest' from "+18y@y" to "01/18/2038:00:00:00". The updated search query would look like

{noformat}| tstats count, latest(_time) as futuretime WHERE index=* earliest=+30min@m latest="01/18/2038:00:00:00" by host, sourcetype | eval _time=now(), time_delta=round((futuretime-_time)/60/60, 2){noformat}

  1. Save the KPI.
  • Note :* the suggested value for the _latest_ parameter is "01/18/2038:00:00:00" because the search executed in different time zones could generate this error again. Therefore, this is the optimal value which could run the search in all the time zones possible in the client environment. 
2022-03-11 ITSI-22487, ITSI-30084 Lookups used in the Incidents Inspector Dashboard do not have corresponding savedsearches to populate the data
2022-03-11 ITSI-22490 Panels of Glass Table of ServiceNow CP are opening in Infrastructure overview dashboard instead of Service Analyzer and drilldown behavior is non-uniform
2022-03-11 ITSI-22491 "ServiceNow - Service Analyzer" does not exclude KPIs/Services of other CPs
2022-02-23 ITSI-22286 The Content Pack for Monitoring Microsoft Windows isn't compatible with the prepackaged Windows Entity Integration in ITE work and ITSI.

Workaround:
There is no workaround at this time.
2022-02-18 ITSI-22168 Service Incidents, KPI Incidents New (1h): search does not calculate the number of newly create incidents within the last hour correctly
2022-02-18 ITSI-22165 All searches should use the itsi-cp-servicenow-indexes macro
2022-02-18 ITSI-22172 Service Incident has an entity rule defined based on entity title but does not make use of entity filtering
2022-02-18 ITSI-22169 Service Incidents, KPI Incidents Closed (1h): search does not calculate the number of closed incidents within the last hour correctly
2022-02-18 ITSI-22166 Wrong search for entity type SNOW Incident, vital metric Total Incidents (1h)
2022-01-05 ITSI-20984 Content pack installed Base searches hit the 100 character limit

Workaround:
Follow the below steps as a workaround:
  1. Clone the KPI Base Search for which the issue is faced.
  2. Identify the Services that are consuming the KPI Base Search results by following the below steps:
    1. Go to ITSI > Configuration > KPI Base Searches
    2. Click on the KPI Base Search for which the issue is faced.
    3. Go to "Dependent KPIs" section.
    4. Identify the list of KPIs and Services dependent on the KPI Base Searches from the list.
  3. Replace the KPI Base Search present in the Service with the Cloned KPI Base Search.

After following above steps, KPIs of the Service should be populated.

2021-11-10 ITSI-19701 Description field is empty in Content Pack ITE Work Alert Routing
Last modified on 05 June, 2023
Fixed issues in the Splunk App for Content Packs   Credits

This documentation applies to the following versions of Splunk® App for Content Packs: 1.6.0


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters