Known issues in Splunk IT Service Intelligence

This version of Splunk IT Service Intelligence has the following known issues and workarounds.

Adaptive Thresholding

Date filed	Issue number	Description
2023-04-26	ITSI-29672	KPI preview fails to render sometimes Workaround: NA
2022-08-23	ITSI-25903	Threshold Template Sync Fails with Empty Alert Values in threshold template

Backup/Restore and Migration Issues

Date filed	Issue number	Description
2022-09-15	ITSI-26204	ITSI Default Scheduled Backup taking hours to complete after upgrade to 4.11.5 (it used to be minutes) Workaround: * Run the below curl command to delete the entry in the collection Template:Itsi migration status {noformat}curl -ku admin https://localhost:8089/servicesNS/nobody/SA-ITOA/storage/collections/data/itsi_migration_status -X DELETE{noformat}

Notable Events

Date filed	Issue number	Description
2023-06-29	ITSI-31192	All Events tab does not render default columns if they are not present in NEAP JSON definition Workaround: # Use the latest ITSI Backup file to edit the NEAP JSON definition and remove the property Template:All events columns and restore the backup. Go to Episode Review page and add back all the desired columns
2023-01-16	ITSI-28046	Alert action configuration UI not loaded in ITSI when the count of alert actions exceed 30 Workaround: Keep the count of alert actions in the instance below 30

KPI Base Searches

Date filed	Issue number	Description
2022-10-05	ITSI-26497	app/itsi/kpi_base_searches_lister error Workaround: N/A
2022-08-23	ITSI-25903	Threshold Template Sync Fails with Empty Alert Values in threshold template

Performance

Date filed	Issue number	Description
2023-04-26	ITSI-29672	KPI preview fails to render sometimes Workaround: NA

Role Based Access Controls

Date filed	Issue number	Description
2021-12-14	ITSI-20605, ITSI-22366	Occasionally after ITSI upgrade, non-admin users get Oops Page - local.meta corrupted during the upgrade Workaround: Clean up all permissions on ITSI views in itsi/metadata/local.meta (and sync on SHC) The workaround is to clean up the stanza in local.meta on the all the SH. remove all the stanza like \[views/....]  that have no valid access settings, (access = delete : \[  ], read : \[  ], write : \[  ]) and that are not custom views from your users. As they may be many, to confirm, you can compare to the list in default.meta And you also can look at the modtime field in the stanza, as they are probably all identical.

Service Analyzer

Date filed	Issue number	Description
2023-02-17	ITSI-28826	Changes to health score color values in threshold_labels.conf do not appear in the service analyzer.

Service Definition

Date filed	Issue number	Description
2022-10-11	ITSI-26591	Thresholding radio button selecting "Use Thresholding Template" instead of "Set Custom Thresholds"

Service Templates

Date filed	Issue number	Description
2022-08-23	ITSI-25903	Threshold Template Sync Fails with Empty Alert Values in threshold template

Uncategorized issues

Date filed	Issue number	Description
2023-03-20	ITSI-29133	Episode Review dashboard panel for Noise reduction should not show "Missing property: majorValue"
2023-01-09	ITSI-27961	Bidirectional Ticketing Correlation Search hits "subsearch limit of 50000 reached" when the collection itsi_notable_event_ticketing has more than 50000 entries Workaround: # Navigate to ITSI -> Configuration -> Correlation Searches Click on Bidirectional Ticketing Paste the following search in the Search field and then click on Save. Also enable the CS if it has been disabled {noformat}| datamodel Ticket_Management Incident search | rename All_Ticket_Management.ticket_id as ticket_id | join ticket_id [search sourcetype="snow:incident" index="<snow_index>" | where _indextime > now() - <max_lookback_time>] | lookup itsi_notable_event_external_ticket tickets.ticket_id as ticket_id OUTPUTNEW tickets.ticket_system event_id | where isnotnull(event_id) | rename tickets.* as * | eventstats values(event_id) as group_id last(ticket_system) as ticket_system by ticket_id | fields - dv_* | table * | makemv group_id | mvexpand group_id | eval bidirectional_ticketing=1, snow_hash = number + "!" + group_id + "!" + sys_updated_on | search NOT [| search index="itsi_tracked_alerts" | fields snow_hash] | dedup snow_hash{noformat} Change the placeholders {{<snow_index>}} and {{<max_lookback_time>}} in the above search with values according to the customer's requirements
2022-12-20	ITSI-27741	When closing episodes in bulk, episodes with different statuses display as closed but aren't actually closed. Workaround: During the bulk update of the episodes from the UI, make sure that all the Episodes selected for the bulk update at a time have same Status.
2022-10-11	ITSI-26585	Entities status is getting "Unstable" from "Active" when installing SA4CP 1.7.0 with ITEW Workaround: # Go to Settings → Searches, Reports, and Alerts Select App → Content Pack for ITSI Monitoring and Alerting (DA-ITSI-CP-monitoring-alerting) Select Owner → All Click on the saved search → ITSI Import Objects - itsi_entity_name_normalizer Edit the search to → | inputlookup itsi_entities | eval entity_name=title Save the saved search
2022-07-12	ITSI-24964	ITSI Searches ("Date Range", "Date & Time Range") do not honor auto-generated values; new Real-time search option fails (tstats not supported in a real-time search) Workaround: For Date & Time selections: manually enter/replace any portion of the auto-filled date for both start and end dates (even if replacing with the same value); or, select date from the calendar dropdown. For Date selection only: No workaround found so far.
2022-07-11	ITSI-24902	ITSI entity management functionality flags previously detected entities as unstable after upgrade to newer versions. Workaround: Delete the existing entities and let the existing entities be re-discovered during next run of the discovery search.
2021-09-01	ITSI-18709	ITSI redirects to suite_redirect 500 Internal Server Error - because of python library isolation between apps Workaround: Step 1: Identify all the splunklib directories within the splunk apps directory using command find . -name 'splunklib' | xargs -r ls -lah. Step 2: For each directory listed in step 1, check if file six.py is present. Step 3: Copy the six.py from an existing splunklib directory into all the missing directories. Step 4: Clean the cached files using find . -name "*.pyc" -delete Step 5: Restart Splunk on the ITE Work or ITSI search head.
2019-05-30	ITSI-3322	If you add a correlation search in ITSI which contains a sub-search returning into an eval, you get a message "Invalid search string: This search cannot be parsed when parse_only is set to true." Workaround: You can't use a sub-search returning into an eval in a correlation search. As a workaround, create and save a basic correlation search with all of the information you want outside of the search. Then as an admin user, go to Settings > Searches, reports, and alerts and open the correlation search you just created. Add the sub-search you were trying to add there.

All ITSI Modules

Publication date	Issue number	Description
2017-03-21	ITOA-7585	When you bulk add services and an error caused by the racing condition occurs, the incorrect message "itsi_module does not exist" is displayed.
2017-03-07	MOD-979	KPIs do not have consistent backfill settings across all modules.
2017-01-17	MOD-452	The Analyze KPI button on the Service Details page is broken.
2017-01-17	MOD-402	The Export to PDF option does not work in the drilldown to a module.
2017-01-17	MOD-296	The extendable tab XML generator REST endpoint is located in DA-ITSI-OS instead of in common components where it can be used by all modules.
2017-01-17	MOD-591	ITSI displays a misleading error message when a KPI template contains a field that cannot be resolved.
2017-01-17	MOD-498	There is no upper limit to the number of characters a KPI title or description can contain. Long strings can negatively affect performance.
2017-01-17	MOD-309	The Gruntfile.js included in ITSI modules uses double quotes instead of single quotes, which does not conform to the standard for all JavaScript files.
2017-04-17	MOD-2002	When you drilldown from the Events tab, an "Invalid earliest_time" error occurs. Workaround: Disable drilldown from the Events tab.
2017-01-17	MOD-439	Some modules do not have descriptions for saved searches.

Application Server Module

Publication date	Issue number	Description
2017-01-27	MOD-492	If you reuse the same panel within a dashboard, the duplicate panel does not display any event data.

Cloud Services Module

There are no known issues for this release.

Database Module

Publication date	Issue number	Description
2017-01-17	MOD-586	When a lookup is not configured for TA-Microsoft-SqlServer, ITSI displays a misleading error message on the server drilldown page.

End User Experience Module

There are no known issues for this release.

Load Balancer Module

Publication date	Issue number	Description
2017-01-27	MOD-492	If you reuse the same panel within a dashboard, the duplicate panel does not display any event data.

Operating System Module

Publication date	Issue number	Description
2017-04-13	MOD-555	The Storage Free Space % base search runs every minute while the Linux df command runs every 5 minutes. This causes data gaps.
2017-04-10	MOD-1964	Windows data for memory free space is collected at different intervals than the Memory Free % KPI.
2017-01-17	MOD-1398	Line, stack, and area charts do not display a metric gap when no metrics are available during a time period.

Storage Module

There are no known issues for this release.

Virtualization Module

There are no known issues for this release.

Web Server Module

Publication date	Issue number	Description
2017-03-17	MOD-320	Some KPI ad hoc searches transform data with the stats command and do not retain time fields. The KPIs do not render anything and do not show thresholding details.
2017-03-17	MOD-538	When you add a new tab with panels and refresh the page, the page breaks.