Splunk® IT Service Intelligence

Event Analytics Manual

Download episodes in ITSI

Download a the list of your episode data in CSV format from the Episode Review page.


Requirement Description
ITSI role You must have the write_itsi_event_management_export capability to generate a CSV file for download, and the read_itsi_event_management_export to download the file.

Filter and prepare episodes for download

Apply filters to find specific episodes from the Episode Review page, and select the download icon to download the entire list of filtered episodes. You can also select individual episodes for download. To generate and download a CSV file in your system, read the following section.

Download episode CSV.png

After selecting the episodes for download, fill out the fields in the modal that appears:

  1. Input a name for your CSV file in the Export as field. Only alphanumeric values, hyphens (-) or underscores (_) are accepted.
  2. Select the field values that you want to include as part of your CSV file. Only the fields selected here will be included. There are two types of fields:
    • Alert: these fields generate a list of values derived from individual events within each episode.
    • Episode: these fields contain information that is specific to an individual episode.
  3. Select Export. The time it takes to generate a CSV depends on the number of episodes being exported, and number and type of fields selected. For example, selecting fields such as Impacted Services, Impacted KPIs, or Comments requires backend searches to find data and may cause longer download times.

Download an existing CSV file

In the episode export modal that appears, select the "Download CSV" tab to view previously generated CSV files.

Note: If you refresh the Episode Review page while a download is in progress, the CSV will be created but doesn't download automatically. To download the CSV, go to the '''Download CSV''' tab.

Delete a CSV file

Your CSV files are stored until they are manually deleted or removed with a modular input. The itsi_exported_episode_files_cleaner modular input cleans up existing CSV files after a specified time period. By default, files are deleted after 7 days, but you can update this configuration in the itsi_event_management.conf file.

Last modified on 30 April, 2024
Customize episode severities in ITSI   Modify episode fields through the REST API

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.19.0

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters