Splunk® IT Service Intelligence

Administration Manual

Acrobat logo Download manual as PDF

Splunk IT Service Intelligence version 4.4.x will no longer be supported as of October 22, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see Before you upgrade IT Service Intelligence.
This documentation does not apply to the most recent version of Splunk® IT Service Intelligence. Click here for the latest version.
Acrobat logo Download topic as PDF

Normalize event fields in ITSI

Normalizing event fields lets you search similar alerts across multiple alert sources much more easily. It also standardizes methods for "grooming" alerts, regardless of their source.

Normalize entity fields

Add a new alias field called entity_name to every entity which might be used as the Entity Lookup field in a notable event correlation search. As a best practice, add entity_name to each entity as an alias containing the title of the entity.

  1. Click Configure > Entities.
  2. Click Create Entity > Import from Search.
  3. Enter the following ad-hoc search:

    | inputlookup itsi_entities | eval entity_name=title

  4. Click Next.
  5. For the entity_name row, change the Import Column As field to Entity Title. Leave all others as Do Not Import
  6. Make sure Conflict Resolution is set to Update Existing Entities.
  7. Click Import.

After the import completes, click View All Entities, then select any entity. It should have an alias field entity_name which contains the name of the entity itself. This field can be used for all notable event correlation searches as the Entity Lookup Field

Last modified on 13 March, 2020
Set up custom episode actions in ITSI
Manage notable events in ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters