
Known issues in Splunk IT Service Intelligence
IT Service Intelligence (ITSI) version 4.6.2 has the following known issues and workarounds.
Splunk platform issues that impact ITSI compatibility
Date filed | Issue number | Description |
---|---|---|
2019-02-14 | SPL-155648 |
[search] phased_execution_mode = auto
See Splunk Enterprise system requirement in the Install and Upgrade Splunk IT Service Intelligence manual. |
Backup/Restore and Migration Issues
Date filed | Issue number | Description |
---|---|---|
2020-05-13 | ITSI-8269 | The default scheduled backup runs twice in the same day. |
2020-01-31 | ITSI-5578 | Upgrade from version 4.2.1 to 4.4.x or higher fails on importing comments because the new HEC token is missing 'itsi_group_comments_token' Workaround: 1. Go to Settings > Data inputs on your ITSI instance. Locate HTTP Event Collector and verify that the "Token Value" field is empty. 2. If the token value is empty, delete the itsi_group_comments_token token through the UI and recreate it by disabling and reenabling the default_hec_initializer modular input at Settings > Data inputs > IT Service Intelligence HEC Initializer. 3. Disable and reenable the migration modular input at Settings > Data inputs > IT Service Intelligence Migration Modular Input. |
2019-07-24 | ITSI-3836 | Objects such as service analyzers, glass tables, and deep dives are missing after upgrade. Workaround: If some objects are missing from the UI or unaccessible after you upgrade, the ACL objects corresponding to the objects might be missing or corrupted. For troubleshooting steps, see https://docs.splunk.com/Documentation/ITSI/latest/Install/Troubleshoot. |
2019-07-23 | ITSI-3830 | Upon upgrade to 4.3.x, correlation searches and multi-KPI alerts are missing the 'all_info' field. |
2019-05-07 | ITSI-3119 | Upgrade fails because a service template sync was queued. Workaround: Delete the backup using the curl command to change its status to Completed. Then force the service template sync. Restart Splunk software to complete the migration. |
2019-01-03 | ITSI-2164 | ITSI backup times out due to an extremely large number of episode comments in the KV store. Workaround: Delete all comments prior to the backup (purge the collections in the KV store) or increase the Splunkd timeout and KV store limits. Then reduce the lifetime of the ITSI notable event collections in the KV store to archive them faster (the default is 6 months). |
2018-10-16 | ITSI-1748 | You cannot restore an ITSI backup more than once. Workaround: This issue occurs because the saved search DA-ITSI-APM-EUEM_Base_Search is missing from the system. Create the missing saved search manually before restoring the backup. For example, create a local version of savedsearches.conf and add the following stanza: [DA-ITSI-APM-EUEM_Base_Search] description = search = request.ui_dispatch_app = itsi request.ui_dispatch_view = search |
2017-02-10 | ITSI-1309 | If multiple services use one KPI base search, and the total size of your services exceeds 50 MB, ITSI generates an error. Workaround: Increase the value for max_size_per_batch_save_mb (50MB is default) in $SPLUNK_HOME/etc/apps/SA-ITOA/local/limits.conf under the [kvstore] stanza. |
2016-05-02 | ITSI-1305 | After migration, shared objects (service analyzers, glass tables, and deep dives) are not accessible. Workaround: Use the curl command and create ACLs for each of the shared objects that are currently saved in the KV store collections: itsi_pages and itsi_service_analyzer. For example: $ curl -u admin:Splunk3r -k https://127.0.0.1:8089/servicesNS/nobody/SA-UserAccess/storage/collections/data/app_acl -X POST -H "Content-Type:application/json" -d '\{ "obj_id": "XXX-XXX-XXX", "obj_type": "glass_table", "obj_app": "itsi", "obj_storename": "itsi_pages", "obj_acl": \{ "obj_owner": "nobody", "read": ["*"], "write": ["*"], "delete": ["*"] }, "object_shared_by_inclusion": "true", "acl_owner": "nobody" }' |
Bulk Import
Date filed | Issue number | Description |
---|---|---|
2020-04-03 | ITSI-6589 | When a non-admin/sc-admin tries to create a recurring import, an error message states that the owner could not be updated to "nobody". Workaround: To update a saved search owner to be "nobody", admins can either change it through the REST API or by editing the local.meta file. |
2015-03-25 | ITSI-1293 | In a search head cluster environment, you cannot set up a recurring import (from CSV or search) through the UI. Workaround: 1. Create the modular input through the UI. ITSI adds the input as a new stanza in $SPLUNK_HOME/etc/apps/itsi/local/inputs.conf . It is not replicated across search peers.
Alternatively, if you're familiar with the format of modular inputs, you can create the input yourself. |
Deep Dive
Date filed | Issue number | Description |
---|---|---|
2020-03-17 | ITSI-6288 | The time picker in a deep dive disappears when clicked, making it impossible to set the time range. |
2019-05-22 | ITSI-3258 | "HTTP 414: URI Too Long" when navigating in the ITSI UI. Workaround: ITSI does not limit URL length, so pages with too many characters fail to load. To work around this issue, limit your request lengths to the following:
|
Entities
Date filed | Issue number | Description |
---|---|---|
2015-02-12 | ITSI-1286 | When importing entities using Data inputs > IT Service Intelligence CSV Import, the page overflows. |
Notable Events
Date filed | Issue number | Description |
---|---|---|
2020-10-22 | ITSI-11620 | Time-based action rules aren't triggered if the flow of events into an episode is paused. |
2020-09-07 | ITSI-10602 | Episodes don't break even if they've existed for longer then the aggregation policy breaking criteria. |
2020-08-05 | ITSI-9929 | When the Rules Engine restarts, time-based policies with split by fields execute actions every minute. |
2020-02-27 | ITSI-5932 | ITSI doesn't support running Splunk Enterprise version 8.0.x with Ubuntu 18.04 and Open JDK 11. Workaround: Use Oracle JDK 11 or Open/Oracle JDK 8 instead of Open JDK 11, or use other versions of Linux. |
2019-10-15 | ITSI-4663 | Upon upgrade to version 4.3.0 or later, the Rules Engine command fails with error: "Error occurred during initialization of VM". Workaround: This issue occurs because 32-bit Java cannot run the Rules Engine with the new memory settings introduced in version 4.3.x.
|
2019-01-03 | ITSI-2164 | ITSI backup times out due to an extremely large number of episode comments in the KV store. Workaround: Delete all comments prior to the backup (purge the collections in the KV store) or increase the Splunkd timeout and KV store limits. Then reduce the lifetime of the ITSI notable event collections in the KV store to archive them faster (the default is 6 months). |
2018-12-10 | ITSI-2059 | Some notable events are added to more than one episode. Workaround: For an ITSI search head running Splunk 7.1 or 7.2, create or edit etc/system/local/limits.conf and add the following stanza: [search] phased_execution_mode = auto For an ITSI search head running Splunk 7.3 or later, there is no need to change anything. |
2017-03-29 | ITSI-1299 | When your browser and the Splunk server are set to different DST time zones, the incorrect time might display for events in Episode Review. Workaround: Set your time zone to something other than "system default" even if you are in the same time zone as the system default. |
2017-03-29 | ITSI-1316 | Splunkd connection fails due to "no_shared cipher matched" between client and server. Workaround: In order for notable event management and anomaly detection to work with Splunk platform 6.6, do the following:
* Download JCE 8 from http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html * Unzip the downloaded file * Place the two jars from the zip file into <java_jre_install_dir>/lib/security/ if running the JRE or <java_jdk_install_dir>/jre/lib/security if running the JDK.
* Download JCE 7 from http://www.oracle.com/technetwork/java/javase/downloads/jce-7-download-432124.html * Unzip the downloaded file * Place the two jars from the zip file into <java_jre_install_dir>/lib/security/ if running the JRE or <java_jdk_install_dir>/jre/lib/security if running the JDK. Update SA-ITOA/local/commands.conf with the following commands: [itsirulesengine] type = custom command.arg.1=-J-Xmx1024M command.arg.2=-Dlog4j.configurationFile=../default/log4j_rules_engine.xml command.arg.3=-DitsiRulesEngine.configurationFile=../default/itsi_rules_engine.properties command.arg.4=-Dhttps.protocols=TLSv1.2,TLSv1.1 command.arg.5=-Dhttps.cipherSuites=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_RSA_WITH_AES_128_CBC_SHA256 chunked = true [itsicorrelationengine] type = custom command.arg.1=-J-Xmx1024M command.arg.2=-Dlog4j.configurationFile=../default/log4j_correlation_engine.xml command.arg.3=-J-XX:+UseConcMarkSweepGC command.arg.4=-DitsiCorrelationEngine.configurationFile=../default/itsi_correlation_engine.properties command.arg.5=-Dhttps.protocols=TLSv1.2,TLSv1.1 command.arg.6=-Dhttps.cipherSuites=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_RSA_WITH_AES_128_CBC_SHA256 chunked = true Update SA-ITSI-MetricAD/local/commands.conf with the following commands: [mad] type = custom command.arg.1=-J-Xmx1G command.arg.2=-Dlog4j.configurationFile=../default/log4j.xml command.arg.3=-Dlog4j2.threadContextMap=com.splunk.mad.util.MadThreadContextMapcommand.arg.4=-Dhttps.protocols=TLSv1.2,TLSv1.1 command.arg.5=-Dhttps.cipherSuites=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_RSA_WITH_AES_128_CBC_SHA256chunked = true |
2016-09-08 | ITSI-1268 | ITSI generates duplicate event_ids from the itsi_tracked_alerts index. This occurs when correlation search results contain an existing event_id. In this case, ITSI picks up the value of the event_id field and does not create a GUID for the event. Workaround: Rename the event_id field. |
2016-04-01 | ITSI-1346 | The 'Ping Host' action does not work when ITSI and Enterprise Security are installed on the same machine. Workaround: 1. Add the following stanza to $SPLUNK_HOME/etc/apps/SplunkEnterpriseSecurity/local/inputs.conf :
[app_imports_update://update_es] apps_to_update = (SA-(?!(ITOA|ITSI|IndexCreation|UserAccess)).*) | (Splunk_SA_.*)
2. Delete the "import = *" line from [] stanza of $SPLUNK_HOME/etc/apps/$APP/metadata/local.meta, where APP=SA-ITOA, SA-ITSI-ATAD, SA-ITSI-LicenseChecker, SA-IndexCreation, SA-UserAccess. |
Notable Event Aggregation Policies
Date filed | Issue number | Description |
---|---|---|
2020-10-22 | ITSI-11620 | Time-based action rules aren't triggered if the flow of events into an episode is paused. |
2020-09-07 | ITSI-10602 | Episodes don't break even if they've existed for longer then the aggregation policy breaking criteria. |
2020-08-05 | ITSI-9929 | When the Rules Engine restarts, time-based policies with split by fields execute actions every minute. |
2020-02-27 | ITSI-5932 | ITSI doesn't support running Splunk Enterprise version 8.0.x with Ubuntu 18.04 and Open JDK 11. Workaround: Use Oracle JDK 11 or Open/Oracle JDK 8 instead of Open JDK 11, or use other versions of Linux. |
2019-10-15 | ITSI-4663 | Upon upgrade to version 4.3.0 or later, the Rules Engine command fails with error: "Error occurred during initialization of VM". Workaround: This issue occurs because 32-bit Java cannot run the Rules Engine with the new memory settings introduced in version 4.3.x.
|
2019-01-03 | ITSI-2164 | ITSI backup times out due to an extremely large number of episode comments in the KV store. Workaround: Delete all comments prior to the backup (purge the collections in the KV store) or increase the Splunkd timeout and KV store limits. Then reduce the lifetime of the ITSI notable event collections in the KV store to archive them faster (the default is 6 months). |
2018-12-10 | ITSI-2059 | Some notable events are added to more than one episode. Workaround: For an ITSI search head running Splunk 7.1 or 7.2, create or edit etc/system/local/limits.conf and add the following stanza: [search] phased_execution_mode = auto For an ITSI search head running Splunk 7.3 or later, there is no need to change anything. |
2017-03-29 | ITSI-1299 | When your browser and the Splunk server are set to different DST time zones, the incorrect time might display for events in Episode Review. Workaround: Set your time zone to something other than "system default" even if you are in the same time zone as the system default. |
2017-03-29 | ITSI-1316 | Splunkd connection fails due to "no_shared cipher matched" between client and server. Workaround: In order for notable event management and anomaly detection to work with Splunk platform 6.6, do the following:
* Download JCE 8 from http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html * Unzip the downloaded file * Place the two jars from the zip file into <java_jre_install_dir>/lib/security/ if running the JRE or <java_jdk_install_dir>/jre/lib/security if running the JDK.
* Download JCE 7 from http://www.oracle.com/technetwork/java/javase/downloads/jce-7-download-432124.html * Unzip the downloaded file * Place the two jars from the zip file into <java_jre_install_dir>/lib/security/ if running the JRE or <java_jdk_install_dir>/jre/lib/security if running the JDK. Update SA-ITOA/local/commands.conf with the following commands: [itsirulesengine] type = custom command.arg.1=-J-Xmx1024M command.arg.2=-Dlog4j.configurationFile=../default/log4j_rules_engine.xml command.arg.3=-DitsiRulesEngine.configurationFile=../default/itsi_rules_engine.properties command.arg.4=-Dhttps.protocols=TLSv1.2,TLSv1.1 command.arg.5=-Dhttps.cipherSuites=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_RSA_WITH_AES_128_CBC_SHA256 chunked = true [itsicorrelationengine] type = custom command.arg.1=-J-Xmx1024M command.arg.2=-Dlog4j.configurationFile=../default/log4j_correlation_engine.xml command.arg.3=-J-XX:+UseConcMarkSweepGC command.arg.4=-DitsiCorrelationEngine.configurationFile=../default/itsi_correlation_engine.properties command.arg.5=-Dhttps.protocols=TLSv1.2,TLSv1.1 command.arg.6=-Dhttps.cipherSuites=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_RSA_WITH_AES_128_CBC_SHA256 chunked = true Update SA-ITSI-MetricAD/local/commands.conf with the following commands: [mad] type = custom command.arg.1=-J-Xmx1G command.arg.2=-Dlog4j.configurationFile=../default/log4j.xml command.arg.3=-Dlog4j2.threadContextMap=com.splunk.mad.util.MadThreadContextMapcommand.arg.4=-Dhttps.protocols=TLSv1.2,TLSv1.1 command.arg.5=-Dhttps.cipherSuites=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_RSA_WITH_AES_128_CBC_SHA256chunked = true |
2016-09-08 | ITSI-1268 | ITSI generates duplicate event_ids from the itsi_tracked_alerts index. This occurs when correlation search results contain an existing event_id. In this case, ITSI picks up the value of the event_id field and does not create a GUID for the event. Workaround: Rename the event_id field. |
2016-04-01 | ITSI-1346 | The 'Ping Host' action does not work when ITSI and Enterprise Security are installed on the same machine. Workaround: 1. Add the following stanza to $SPLUNK_HOME/etc/apps/SplunkEnterpriseSecurity/local/inputs.conf :
[app_imports_update://update_es] apps_to_update = (SA-(?!(ITOA|ITSI|IndexCreation|UserAccess)).*) | (Splunk_SA_.*)
2. Delete the "import = *" line from [] stanza of $SPLUNK_HOME/etc/apps/$APP/metadata/local.meta, where APP=SA-ITOA, SA-ITSI-ATAD, SA-ITSI-LicenseChecker, SA-IndexCreation, SA-UserAccess. |
Glass Table
Date filed | Issue number | Description |
---|---|---|
2020-09-24 | ITSI-11067 | You can only configure the background color of an icon, not the color of the icon itself. |
2020-08-31 | ITSI-10511 | After upgrading, the text in beta glass tables is no longer showing. |
2020-04-14 | ITSI-6893 | Beta glass tables don't support Predictive Analytics visualizations. Workaround: After pasting in the search for the ad hoc visualization, enter source mode and locate the visualization. Under "encoding", change the trend from "primary[0]" to "primary.next30m_worst_hs". |
2020-04-03 | ITSI-6597 | If you bind a table visualization to a KPI data source, pagination and column sorting don't work. Workaround: Copy the search string from a KPI data source and place it inside a new ad hoc data source. |
2020-01-23 | ITSI-5441, SCP-24854 | The data source panel doesn't update when the beta glass table definition changes. Workaround: Reload the page or close and reopen the data source panel. |
2019-11-18 | ITSI-4891 | Visualizations are added with TimeRange tokens even if the time picker doesn't exist. |
KPI Base Searches
Date filed | Issue number | Description |
---|---|---|
2020-01-07 | ITSI-5220 | Shared base searches are generating thousands of "Broken Socket" messages but ITSI functionality is not impacted. |
KPI Search Calculation
Date filed | Issue number | Description |
---|---|---|
2020-10-20 | ITSI-11551 | KPI alerting stops working after upgrade. |
2020-09-25 | ITSI-11102 | KPI alerting fails to create notable events when the KPI severity changes to and from N/A. Workaround: Comment out the following line in $SPLUNK_HOME/etc/apps/SA-ITOA/bin/command_set_severity_fields.py to disable the backfill check: self._check_historical_data(result.get('_time')) As a side effect, KPI alerting might trigger automatically during initial backfill. |
Role Based Access Controls
Date filed | Issue number | Description |
---|---|---|
2019-03-29 | ITSI-2860 | If you assign the write_itsi_correlation_search capability to the itoa_analyst role, the role still cannot create a correlation search. Workaround: In addition to assigning the write_itsi_correlation_search capability to the itoa_analyst role, create a local.meta file at SPLUNK_HOME/etc/apps/itsi/metadata/ and add "itoa_analyst" to the [savedsearches] stanza.
For example: [savedsearches] access = read : [ * ], write: [ itoa_admin, itoa_team_admin, itoa_analyst ], delete: [ itoa_admin, itoa_team_admin, itoa_analyst ] export = system |
Service Analyzer
Date filed | Issue number | Description |
---|---|---|
2019-09-19 | ITSI-4424 | The itoa_admin role cannot permanently dismiss the cyclic dependency warning. |
2019-05-22 | ITSI-3258 | "HTTP 414: URI Too Long" when navigating in the ITSI UI. Workaround: ITSI does not limit URL length, so pages with too many characters fail to load. To work around this issue, limit your request lengths to the following:
|
2017-10-04 | ITSI-1290 | Filters with no matching results can't be saved in the Service Analyzer. |
Service Definition
Date filed | Issue number | Description |
---|---|---|
2016-03-28 | ITSI-1269 | On Windows 10 on Chrome, some selectors in the ITSI app do not function. |
Predictive Analytics
Date filed | Issue number | Description |
---|---|---|
2019-03-20 | ITSI-2801 | Predictive Analytics occasionally fails to train models on Windows. Workaround: If search.log for the fit command reports the following error: ERROR ChunkedExternProcessor - stderr: ImportError: DLL load failed: The application has failed to start because its side-by-side configuration is incorrect. Please see the application event log or use the command-line sxstrace.exe tool for more detail. To resolve this issue, reinstall of Visual C++ 2008 runtime: [1] |
Splunk App for Infrastructure Integration
Date filed | Issue number | Description |
---|---|---|
2019-05-21 | ITSI-3248 | The itoa_admin role does not have permission to create alerts in SAI. |
2018-09-24 | ITSI-1654 | Only 50,000 entities can be imported from the Splunk App for Infrastructure. Workaround: By default, the entity integration imports up to 50,000 entities from the Splunk App for Infrastructure. If you have more than 50,000 entities in Splunk App for Infrastructure, only the first 50,000 will be imported into ITSI. Increase the max_rows_per_query setting in $SPLUNK_HOME/etc/apps/SA-ITOA/local/limits.conf under the [kvstore] stanza to import more than 50,000 entities. |
Uncategorized issues
Date filed | Issue number | Description |
---|---|---|
2020-09-28 | ITSI-11173 | "Unable to retrieve Java version on this machine, make sure Java is properly installed" on Windows 2016. |
2020-08-31 | ITSI-10492 | The KPI performance runtime headroom calculation on the ITSI Health Check dashboard is incorrect for search head clusters. Workaround: Upgrade to ITSI version 4.7.0. Alternatively, on older versions, clone the dashboard and then edit the copy to make the first "| stats count AS run_count ..." with "| stats dc(sid) AS run_count ..." only report on the unique number of invocations for each search. |
2020-07-18 | ITSI-9516 | If you edit the default navigation of a default entity type, the corresponding dashboard is removed from the dashboard dropdown list in its linked entities and instead appears as a navigation suggestion on the right panel. Workaround: Don't edit the default navigations of any of the default entity types shipped with ITSI. You can still add additional navigations if you want.
|
2020-06-04 | ITSI-8803 | The "Send to Phantom" episode action is not available on version 4.4.4 and higher. |
2020-03-20 | ITSI-6421, SCP-24922, SII-6872 | ITSI fails to load on Internet Explorer 11. |
2020-01-14 | ITSI-7334, SII-6992 | Alerts break if the underlying data is moved to a different index. Workaround: Manually change the index for the alert. |
2019-06-08 | ITSI-3437 | Correlation searches don't work with real-time searches. |
2019-05-30 | ITSI-3322 | If you add a correlation search in ITSI which contains a sub-search returning into an eval, you get a message "Invalid search string: This search cannot be parsed when parse_only is set to true." Workaround: You can't use a sub-search returning into an eval in a correlation search. As a workaround, create and save a basic correlation search with all of the information you want outside of the search. Then as an admin user, go to Settings > Searches, reports, and alerts and open the correlation search you just created. Add the sub-search you were trying to add there. |
2019-02-12 | ITSI-2471 | If ITSI is installed on multiple environments with multiple license masters, and any indexer interacts with both environments, a duplicate licensing error occurs because both environments have the same auto-generated ITSI license stack. Workaround: Follow the workaround described in the deployment planning docs for the version of ITSI you're currently using: https://docs.splunk.com/Documentation/ITSI/latest/Install/Plan#ITSI_license_requirements |
2018-06-27 | ITSI-1287, ITSI-793 | Correlation searches created by manually editing savedsearches.conf do not appear on the correlation search lister page. Workaround: Do not create correlation searches by manually editing $SPLUNK_HOME/etc/apps/itsi/local/savedsearches.conf . The search will not appear on the correlation search lister page. Always create correlation searches directly in the IT Service Intelligence app. |
2015-12-01 | ITSI-1320 | When you install Enterprise Security on a search head with a pre-existing installation of ITSI, the ES-specific roles overwrite the ITSI-specific roles assigned to admin role. This disables access to all read/write objects in ITSI. Workaround: 1. In Splunk Web, go to Settings > Access Controls. 2. Select Roles > admin. |
All ITSI Modules
Publication date | Issue number | Description |
---|---|---|
2017-03-21 | ITOA-7585 | When you bulk add services and an error caused by the racing condition occurs, the incorrect message "itsi_module does not exist" is displayed. |
2017-03-07 | MOD-979 | KPIs do not have consistent backfill settings across all modules. |
2017-01-17 | MOD-452 | The Analyze KPI button on the Service Details page is broken. |
2017-01-17 | MOD-402 | The Export to PDF option does not work in the drilldown to a module. |
2017-01-17 | MOD-296 | The extendable tab XML generator REST endpoint is located in DA-ITSI-OS instead of in common components where it can be used by all modules. |
2017-01-17 | MOD-591 | ITSI displays a misleading error message when a KPI template contains a field that cannot be resolved. |
2017-01-17 | MOD-498 | There is no upper limit to the number of characters a KPI title or description can contain. Long strings can negatively affect performance. |
2017-01-17 | MOD-309 | The Gruntfile.js included in ITSI modules uses double quotes instead of single quotes, which does not conform to the standard for all JavaScript files. |
2017-04-17 | MOD-2002 | When you drilldown from the Events tab, an "Invalid earliest_time" error occurs.
|
2017-01-17 | MOD-439 | Some modules do not have descriptions for saved searches. |
Application Server Module
Publication date | Issue number | Description |
---|---|---|
2017-01-27 | MOD-492 | If you reuse the same panel within a dashboard, the duplicate panel does not display any event data. |
Cloud Services Module
There are no known issues for this release.
Database Module
Publication date | Issue number | Description |
---|---|---|
2017-01-17 | MOD-586 | When a lookup is not configured for TA-Microsoft-SqlServer, ITSI displays a misleading error message on the server drilldown page. |
End User Experience Module
There are no known issues for this release.
Load Balancer Module
Publication date | Issue number | Description |
---|---|---|
2017-01-27 | MOD-492 | If you reuse the same panel within a dashboard, the duplicate panel does not display any event data. |
Operating System Module
Publication date | Issue number | Description |
---|---|---|
2017-04-13 | MOD-555 | The Storage Free Space % base search runs every minute while the Linux df command runs every 5 minutes. This causes data gaps. |
2017-04-10 | MOD-1964 | Windows data for memory free space is collected at different intervals than the Memory Free % KPI. |
2017-01-17 | MOD-1398 | Line, stack, and area charts do not display a metric gap when no metrics are available during a time period. |
Storage Module
There are no known issues for this release.
Virtualization Module
There are no known issues for this release.
Web Server Module
Publication date | Issue number | Description |
---|---|---|
2017-03-17 | MOD-320 | Some KPI ad hoc searches transform data with the stats command and do not retain time fields. The KPIs do not render anything and do not show thresholding details.
|
2017-03-17 | MOD-538 | When you add a new tab with panels and refresh the page, the page breaks. |
PREVIOUS Fixed issues in Splunk IT Service Intelligence |
NEXT Removed features in Splunk IT Service Intelligence |
This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.6.2 Cloud only
Feedback submitted, thanks!