Removed features in Splunk IT Service Intelligence

This page lists computing platforms, browsers, and features for which IT Service Intelligence (ITSI) has deprecated or removed support in version 4.4.x.

What does "removed" mean?

When ITSI removes support for a feature, browser, or platform, it means that the feature, browser, or platform no longer works with the ITSI platform, and customers must find an alternative.

The following features are removed in ITSI version 4.4.x.

Removed feature	Description
Concurrent real-time search	Support for concurrent real-time search is removed in version 4.4.0. By default, ITSI uses an indexed real-time search for the itsi_event_grouping search in $SPLUNK_HOME/etc/apps/SA-ITOA/default/savedsearches.conf to retrieve notable events from the Splunk platform. Disabling this search in favor of concurrent real-time search is unsupported because it significantly impacts system performance.
Module Builder	Support for the Module Builder is removed in version 4.4.0. The Module Builder functionality is being migrated over to the ability to package ITSI content using the backup/restore functionality.
Event Management SDK	The external Event Management SDK is deprecated and no longer supported. If you have scripts based on this refactored SDK, you can continue using them, but it is recommended to eventually port them to use the original Notable Event Actions SDK that is shipped with ITSI, as it will be updated going forward.
itsi_notable_event_comment collection	The itsi_notable_event_comment KV store collection is removed. ITSI episode comments are now stored in the index rather than the KV store. When you upgrade to version 4.4.x, all existing episode comments are migrated from the KV store to the index.
POST and DELETE operations on episode comments	Episode comments are now append only. You can no longer perform DELETE operations on comments at the event_management_interface/<object_type> endpoint or POST operations on comments at the event_management_interface/<object_type>/<object_identifier> endpoint. Since episode comments are now append only, the following functions were removed from the Notable Event Actions SDK grouping.EventGroup class: delete_all_comments delete_comment update_comment
Classic glass table framework - ADVANCE NOTICE	In a future major release, you will no longer be able to create or clone glass tables in the classic framework. You will still be able to edit existing classic glass tables. All classic glass tables in your environment will be cloned to the beta framework. The beta framework will soon become the official and only framework, so it is recommended that you begin to use this new framework exclusively. For more information, see Overview of the beta glass table editor in ITSI.
REST calls through SPL searches without "report_as" parameter	The default header Content-Type: application/json was added to all /SA-ITOA/... endpoint responses. The response will still be in JSON format. However, if you want to continue using REST for ITSI endpoints in the context of Splunk search, you must add report_as=text to your searches. The following Splunk search type no longer works if you don't include the report_as parameter: | rest splunk_server=local /servicesNS/nobody/SA-ITOA/... fields="_key,title" | eval(...) You must change the search to the following format: | rest splunk_server=local /servicesNS/nobody/SA-ITOA/... fields="_key,title" report_as=text| eval(...)