Splunk® IT Service Intelligence

Event Analytics Manual

Download manual as PDF

Download topic as PDF

Customize Episode Review in ITSI

You can customize different properties of a saved Episode Review dashboard to better suit your organization's needs and accelerate triage and investigation. Use the View Settings to customize the look and feel of Episode Review, set the refresh rate, add or remove columns, or configure other default settings.

Prerequisites

By default, read and write permissions are granted to all roles for a newly created view of Episode Review. To restrict permissions, see Modify analyst permissions within Episode Review in ITSI.

Change the viewing mode

By default, each Episode Review dashboard is in Standard mode, which means the severity color is only displayed to the right of the episode row. You can change the viewing mode to Prominent to fill the entire row with the severity color.

To change the viewing mode, click the gear icon ITSI gear.png and change Viewing Option to Standard or Prominent.

The following image shows the difference between Standard and Prominent modes:

ProminentMode.png

Turn episode view on or off

By default, Episode Review displays episodes rather than notable events. Depending on what kind of issues your organization deals with, you might want to view individual notable events rather than episodes.

To change the episode view, click the gear icon ITSI gear.png and turn Episode View on or off.

Change the episode view default tab

By default, when you select an episode, the Impact tab is displayed in the details panel. Depending on the types of issues you're investigating, you might want to display a more relevant tab, such as the Events Timeline or Common Fields. You can modify the default tab that's selected on a per-dashboard basis. In other words, all episodes within that Episode Review saved view will have the same tab selected by default.

To change the default tab, click the gear icon ITSI gear.png and use the Episode View Default Tab dropdown to select the tab.

After making the change, click through several episodes to make sure the default tab changed.

Set the auto refresh period

The auto refresh rate determines how often Episode Review is refreshed to display new episodes and events. By default the refresh period is set to Off, which means it never automatically refreshes and you need to refresh your browser to update the dashboard. You can change the refresh period to 1 minute, 5 minutes, 30 minutes, 60 minutes, or 24 hours.

To change the refresh rate, click the gear icon ITSI gear.png and use the Auto Refresh Period dropdown to select a time.

Add and remove columns

Each row in Episode Review displays a default set of columns: Title, Time, Owner, Severity, Status, and Description. You can add, remove, or rearrange columns based on which fields are important to your investigation. For example, you might add an All Tickets column to display any ticket linked to each episode.

To edit the columns for a specific view, click the gear icon ITSI gear.png and use the Columns Shown section to add, remove, or rearrange columns.

After making the change, check and confirm that the column was added.

Last modified on 31 July, 2020
PREVIOUS
Overview of episode management in ITSI
  NEXT
Modify analyst permissions within Episode Review in ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.6.0 Cloud only, 4.6.1 Cloud only, 4.6.2 Cloud only


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters