Overview of episode management in ITSI
The Episode Review dashboard in IT Service Intelligence (ITSI) enables organizations to manage communications related to major business issues or incidents. Episode Review allows incident communications administrators to bring together all involved users during these episodes and establish quick and easy communication within the group.
For example, a major issue occurs in a server room, which leads to a high-priority incident being raised. The episode can potentially impact all users, so it's important to bring together key representatives to communicate quickly and effectively. Episode Review can facilitate this communication process and help resolve the source issue.
The goal of Episode Review is to restore normal service operation while minimizing impact to business operations and maintaining quality. The dashboard displays a unified view of all your service-impacting alerts as episodes in their current state.
ITSI Episode Review supports the episode management process in the following ways:
- Classify episodes by impact and urgency to prioritize work.
- Assign to appropriate users for quick resolution.
- Escalate as necessary for further investigation.
- Resolve the episode and notify the user who logged it.
Any user can assign an episode to themselves and track it through the entire episode lifecycle until a service is restored and the issue is resolved.
What's an episode?
An episode represents a disruption of service operation causing impact to business operations. It's a deduplicated group of events occurring as part of a larger sequence, or an incident or period considered in isolation.
Examples of application-level episodes could be service unavailability, a data issue, an application bug, or disk-usage threshold exceeded. Examples of hardware episodes include server issues, network issues, or system issues. The Episode Review dashboard is designed to separate and organize these issues in your IT environment so that analysts can effectively triage, investigate, escalate, and resolve them.
Episodes are generated through notable event aggregation policies. Aggregation policies group similar or related notable events into episodes based on the filtering criteria you define. For more information about configuring aggregation policies, see Overview of aggregation policies in ITSI.
Lifecycle of an episode
Episode Review is responsible for managing the life cycle of episodes from creation to closure. The episode management process has several statuses, each of which is important to the success of the process and the quality of service delivered.
An episode can have the following default statuses:
|Unassigned||Used by ITSI when an error prevents the episode from having a valid status assignment.|
|New||Default status. The episode is logged but has not been triaged.|
|In Progress||The episode is assigned and the owner is investigating the issue.|
|Pending||The responsibility for the episode shifts temporarily to another entity to provide further information, evidence, or a resolution. An action must occur before the episode can be closed.|
|Resolved||The owner has addressed the cause of the episode and is waiting for verification. A satisfactory fix is provided to ensure it doesn't occur again.|
|Closed||It's confirmed that the episode is satisfactorily resolved.|
For information about how analysts can leverage Episode Review, including the process of triaging, investigating, and taking action on episodes, see Overview of Episode Review in ITSI in the ITSI User Manual.
Group similar events with Smart Mode in ITSI
Customize Episode Review in ITSI
This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.5.0 Cloud only, 4.5.1 Cloud only, 4.6.0 Cloud only, 4.6.1 Cloud only, 4.6.2 Cloud only, 4.7.0, 4.7.1, 4.7.2