Splunk® IT Service Intelligence

Administration Manual

Acrobat logo Download manual as PDF

This documentation does not apply to the most recent version of ITSI. Click here for the latest version.
Acrobat logo Download topic as PDF

Modify episode fields through the REST API

In addition to modifying episode fields directly within Episode Review in IT Service Intelligence (ITSI), you can also use the REST API to make changes to episode fields. The ITSI Event Management Interface encapsulates CRUD operations on Event Analytics objects, including episodes, aggregation policies, and correlation searches. For the full reference, see Event Management Interface in the REST API Reference manual.

Update the severity of an episode

The following example changes an episode's severity to 6 (Critical):

curl -k -u admin:password https://localhost:8089/servicesNS/nobody/SA-ITOA/event_management_interface/notable_event_group/{episode_id}/?is_partial_data=1 -X POST -H "Content-Type:application/json" -d '{"severity": "6"}' 

The request returns the ID of the updated episode.

Default episode severity codes:

  • 1 - Info
  • 2 - Normal
  • 3 - Low
  • 4 - Medium
  • 5 - High
  • 6 - Critical

The severity codes are controlled by $SPLUNK_HOME/etc/apps/SA-ITOA/default/itsi_notable_event_severity.conf. For more information about what each severity means and how to customize the file, see Customize episode severities in ITSI.

Update the assignee of an episode

The following example changes an episode's assignee to "Jeff":

curl -k -u admin:password https://localhost:8089/servicesNS/nobody/SA-ITOA/event_management_interface/notable_event_group/{episode_id}/?is_partial_data=1 -X POST -H "Content-Type:application/json" -d '{"owner": "Jeff"}' 

The request returns the ID of the updated episode.

Update the status of an episode

The following example changes an episode's status to 2 (In Progress):

curl -k -u admin:password https://localhost:8089/servicesNS/nobody/SA-ITOA/event_management_interface/notable_event_group/{episode_id}/?is_partial_data=1 -X POST -H "Content-Type:application/json" -d '{"status": "2"}' 

The request returns the ID of the updated episode.

Default episode status codes:

  • 1 - New
  • 2 - In Progress
  • 3 - Pending
  • 4 - Resolved
  • 5 - Closed

The severity codes are controlled by $SPLUNK_HOME/etc/apps/SA-ITOA/default/itsi_notable_event_status.conf. For more information about what each status means and how to customize the file, see Customize episode statuses in ITSI.

Close and break an episode

To break an episode through the REST API, you must send a breaking event to the itsi_tracked_alerts index:

curl -k -u admin:changeme https://localhost:8089/servicesNS/nobody/SA-ITOA/event_management_interface/notable_event_group?break_group_policy_id={policy_id} -X POST --data '{"_key":"{episode_id}","status":"5","title":"splunkd_access","description":"None","severity":"1","owner":"unassigned"}' --header "Content-Type: application/json"

The "Closed" status value, which is 5 by default, is defined in $SPLUNK_HOME/etc/apps/SA-ITOA/default/itsi_notable_event_status.conf. If you update this value, you must also update the REST API body with correct status value.

Last modified on 15 June, 2020
PREVIOUS
Manage notable events in ITSI
  NEXT
Tune notable event grouping in ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1, 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters