Splunk® IT Service Intelligence

Event Analytics Manual

Overview of correlation searches in ITSI

A correlation search in IT Service Intelligence (ITSI) is a recurring search that scans multiple data sources for defined patterns. You can configure a correlation search to generate a notable event (alert) when search results meet specific conditions. Review notable events that your correlation searches generate in Episode Review and initiate the investigative process of determining root cause.

You can use an ITSI correlation search to ingest third-party alerts as ITSI notable events. If you're creating a correlation search to ingest alerts from a third-party product, such as Nagios or SCOM, see Ingest third-party alerts into ITSI for specific instructions.

Do not create correlation searches by manually editing $SPLUNK_HOME/etc/apps/itsi/local/savedsearches.conf. The search will not appear on the correlation search lister page. Always create correlation searches directly in the IT Service Intelligence app.

Correlation searches for ITSI-specific use cases

The following correlation searches are delivered with ITSI to complement product-specific features. You can enable them and modify them to meet your needs.

Name Description Default status
Bidirectional Ticketing Maps ServiceNow fields to Common Information Model (CIM) fields to enable bidirectional ticketing with ServiceNow. See Integrate ITSI with ServiceNow for information. Disabled
BMC Remedy Bidirectional Ticketing Maps BMC Remedy fields to Common Information Model (CIM) fields to enable bidirectional ticketing with BMC Remedy. See Integrate ITSI with BMC Remedy for more information. Disabled
Monitor Critical Service Based on Health Score Generates notable events for services with a critical health score. Disabled
Normalized Correlation Search Generates notable events for any third-party alerts being ingested into ITSI that include ITSI normalized fields. If you enable this search, ITSI generates notable events for all third-party alerts that contain the following normalized fields, including those from SAI:
  • itsiAlert
  • itsiDetails
  • itsiInstance
  • itsiRawStatus
  • itsiSeverity
  • itsiSubInstance
SNMP Traps Generates notable events for SNMP traps being ingested into ITSI. See Ingest SNMP traps into ITSI for more information. Disabled
Last modified on 22 June, 2023
Overview of Event Analytics in ITSI   Configure Event Analytics for federated search head in ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.14.0 Cloud only, 4.14.1 Cloud only, 4.14.2 Cloud only, 4.15.0, 4.15.1, 4.15.2, 4.15.3, 4.16.0 Cloud only, 4.17.0, 4.17.1, 4.18.0, 4.18.1, 4.19.0

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters