Known issues in Splunk IT Service Intelligence

This version of IT Service Intelligence (ITSI) has the following known issues and workarounds.

Predictive Analytics

Date filed	Issue number	Description
2024-08-06	ITSI-36922	Updates to the Machine Learning Toolkit and the Splunk Python for Scientific Computing affect ITSI predictive analytics. For more information, see For ITSI customers in the Splunk Machine Learning Toolkit documentation. Workaround: Install the Splunk Machine Learning Toolkit version 5.4.2. Re-train all the models (Gradient Boosting Regressor, Random Forest Regressor, Linear Regression and Logistic Regression) on the services with predictive analytics. Delete the existing correlation searches for the trained model, or update the existing correlation search to refer to the newly trained model(s). If the correlation search was deleted, re-create the correlation searches and reference the newly trained model(s).

Adaptive Thresholding

Date filed	Issue number	Description
2024-09-04	ITSI-37270	Use Recommended Thresholding Configuration cannot use all backfilled events Workaround: While backfilling the KPI customer can set the fill data gaps option other than Template:Last available value and after backfill completes successfully they can switch the option to Template:Last available value.
2024-04-12	ITSI-35070	On few KPIs using adaptive threshold, the results from the scheduled overnight run seem very different from the preview adaptive threshold results Workaround: Add {{| where not isnull(alert_value)}} before Template:Applyat command in the AT search to remove the empty Template:Alert value events.

Bulk Import

Date filed	Issue number	Description
2024-06-12	ITSI-36277	Bulk import is not handling the duplicate column title in csv file

Notable Events

Date filed	Issue number	Description
2024-07-18	ITSI-36713	Rules engine not backfilling events when the RE is restarted
2024-06-25	ITSI-36467	Investigate the ConcurrentModificationException in rules engine process Workaround: Update the below changes *on each SH* to disable async execution of actions in Rules Engine. Go to Template:$SPLUNK HOME/etc/apps/SA-ITOA/local/itsi rules engine.properties There should be a param Template:Rules engine feature disabled list in the file if not available then add this param with values as given in point-3. Add the value Template:RUN ACTION ASYNC to the comma separated list of values {noformat}rules_engine_feature_disabled_list = POLICY_EXECUTOR_ASYNC_SUB_ACTORS, POLICY_EXECUTOR_STATE_RECOVERY, SORT_NOTABLE_EVENTS, RUN_ACTION_ASYNC{noformat} Restart the Template:Itsi event grouping real time search by going to Activity → Jobs → Set filters to "All" → search Template:Label="itsi event grouping" and then stop the job. It will restart after a couple of mins
2024-06-20	ITSI-36397	Actions are not performed if the event is breaking the episode based on the timebased criteria and grouping into a new group. Workaround: Reset Template:Policy rules check frequency delay to 60000 under Template:$SPLUNK HOME/etc/apps/SA-ITOA/local/itsi rules engine.properties OR Update the action rules in the new to perform the action when Template:Number of events in this episode is less than or equals to 2 if the action is Template:Number of events in this episode is == 1

KPI Search Calculation

Date filed	Issue number	Description
2024-06-05	ITSI-35981	Time based threshold policies are not working for the entities.

Performance

Date filed	Issue number	Description
2024-07-23	ITSI-36787, ITSI-31548	App SA-ITSI-AT-Recommendations and SA-ITSI-DriftDetection failing Python3 readiness check

Service Analyzer

Date filed	Issue number	Description
2024-05-23	ITSI-35809	Could not retrieve health scores for the service tiles.

Service Definition

Date filed	Issue number	Description
2024-09-10	ITSI-37299	Discrepancy in the "Per-Entity Threshold Value" graph

Uncategorized issues

Date filed	Issue number	Description
2024-06-06	ITSI-36019	Discrepancy in time in the user_access_interface.log file
2024-05-31	ITSI-35922	events from source itsi_appserver.log are way longer than new increased TRUNCATE limit Workaround: Copy the below stanza in Template:Apps/SA-ITOA/package/local/props.conf from Template:Apps/SA-ITOA/package/default/props.conf and increased TRUNCATE value with Template:200000. {noformat}[source::...(/|\\)var(/|\\)log(/|\\)splunk(/|\\)itsi*] TIME_PREFIX=^ TIME_FORMAT=%Y-%m-%d %H:%M:%S,%3N%z LINE_BREAKER =([\r\n]+)\d{4}-\d{2}-\d{2}\s SHOULD_LINEMERGE = false TRUNCATE = 100000 MAX_TIMESTAMP_LOOKAHEAD = 29 sourcetype = itsi_internal_log EXTRACT-component = ^[^\[\n]*\[(?P<component>[^\]]+) EXTRACT-sub_component = ^[^\]\n]*\]\s+\[(?P<sub_component>[^:\]]+) EXTRACT-log_level = ^[^\[\n]*\s+(?P<log_level>(?:\w+))\s+\[{noformat}
2024-05-21	ITSI-35776	As an itoa_admin, when upgrading ITE-W to ITSI and then downgrading the app label still says IT Essentials Work Workaround: # The cache automatically clears after 24 hours, and this automatically resolves the issue. In order to manually remove the local storage, go to *Chrome Developer Tools,* then *Applications*, then *Local Storage* and delete the key splunk-appnav:itsi:admin:en-GB.
2024-05-09	ITSI-35608	Getting new lines before and after every line of CSV when downloading it on windows instance
2024-05-08	ITSI-35592	Deleting associated service template from a service in the service sandbox does not update the linked service template count.
2024-04-26	ITSI-35428	Customer wants to know whether Index references needs to be changed in scripts for default ITSI indexes.
2023-12-22	ITSI-33539	Closing an Episode when Rules Engine is disabled does not break the Episode