Splunk® IT Service Intelligence

Release Notes

Acrobat logo Download manual as PDF

Splunk IT Service Intelligence version 4.7.0 reached its End of Life on October 28, 2022.
This documentation does not apply to the most recent version of Splunk® IT Service Intelligence. Click here for the latest version.
Acrobat logo Download topic as PDF

New features in Splunk IT Service Intelligence

Version 4.7.x has the following new and changed features.

For compatibility information, see Splunk Enterprise system requirements in the Install and Upgrade manual.

Event Analytics

New feature or enhancement Description
Set episode severity to the highest or lowest event severity You can now set an episode's severity to be equivalent to the highest or lowest event severity within that episode. For more information, see Configure episode information and episode dashboards in ITSI in the Event Analytics manual.
Event filters in Episode Review Filter episodes by notable event field values. Only episodes with the selected field-value pair are shown. For more information, see Accelerate triage with filters and sorting in the User Manual.
Sub-sort in Episode Review A new sub-sort option is available in Episode Review that lets you hierarchically sort by multiple episode attributes. For more information, see Accelerate triage with filters and sorting in the User Manual.
Right-click on episodes to perform actions You no longer need to open an episode in Episode Review in order to perform an action on it. Instead of using the Actions dropdown, you can now right-click on an episode and directly select from a list actions.
Phantom ticketing integration The Send to Phantom episode action, which was temporarily removed in version 4.4.4, is available again. You must use the Phantom App for Splunk version 4.0.10 or higher, which offers Python 3 compatibility. To set up the integration, see Integrate ITSI with Splunk Phantom.
Episode Review Impact tab enhancements The following enhancements were made to the Impact tab of episodes
  • Placed All Tickets and Reference Links at the top of the tab
  • Separated Impacted Services and Impacted KPIs into separate sections
  • Show impacted services and KPIs by health score in ascending order
  • Show a bar gauge of health scores and count by severity
  • Show three tiles per section by default with the option to expand and see more
Action execution performance improvements The Rules Engine now uses batch requests to run episode actions. It uses parallel jobs to improve bulk action latency and throughput. This change improves the responsiveness and overall performance of action execution and bulk ticket creation.

Glass table editor

New feature or enhancement Description
Beta glass table framework moved to official framework The new glass table is no longer in beta. It has replaced the classic glass table framework. All classic glass tables still exist in your environment upon upgrade and can still be edited. However, you must create all new glass tables in the new framework.

You can convert your existing classic glass tables to the new framework using the upgrade option on the glass table lister page, which creates a clone of the original glass table in the new framework. You can then modify the new version of the glass table while still having the old version to reference.

Drilldown to saved views You can add drilldown links to saved ITSI views such as service analyzers, deep dives, or dashboards. For more information, see Configure drilldowns in the Service Insights manual.
Download glass tables View mode in glass tables now includes a Download button where you can download the glass table in PNG or PDF format.
Visualization action buttons in View mode You can take the following actions on visualizations in View mode:
  • Open the corresponding search
  • Open the visualization in full screen mode
  • Export the visualization content in PNG format
Visualization progress bar and status When a search is long, a visualization displays a blue progress bar. If there's an issue with loading the data, a yellow or red dot on the visualization indicates the reason for the error.
Show or hide the title and description You can choose whether to display the glass table title and description on the canvas or in the toolbar. This information is displayed in the toolbar by default. For more information, see Show or hide the title and description in the Service Insights manual.
Set separate time ranges for KPI visualizations An individual KPI can now "opt out" from search aggregation. Previously, you couldn't set separate time ranges for KPI or service health score visualizations because they were powered by the search aggregator. For more information, see Set different time ranges for visualizations in the Service Insights manual.
Define default properties The new defaults section of the glass table definition lets you define default properties for various glass table elements. For more information, see Define default properties for glass tables in ITSI in the Service Insights manual. All existing glass tables will be updated with the new defaults section.

Service Analyzer

New feature or enhancement Description
KPI threshold information in the Service Analyzer Hover over a KPI in the Service Analyzer side panel to see a breakdown of threshold levels for that KPI as well as its current value.

Deep dives

New feature or enhancement Description
Custom deep dive drilldowns for specific KPIs A new setting called kpi_titles_with_drilldown was added to deep_dive_drilldowns.conf that lets you drill down to a specified URI when viewing the entity overlays for that KPI in a deep dive.

Entity Integrations

New feature or enhancement Description
VMware Datastore entity integration A new entity type called VMware Datastore was added to help you analyze VMware datastore entity data. The entity type provides custom visualizations for VMware datastore entities, including the VMware Datastore Overview Dashboard. For more information, see Collect VMware datastore performance metrics in the Entity Integrations manual.
Infrastructure Overview The Infrastructure Overview provides a holistic view of all the active entities in your environment as well as the health of those entities across various platforms. For more information, see About the Infrastructure Overview in ITSI in the User Manual.
Vital metrics for entity types Vital metrics are statistical calculations based on SPL searches that represent the overall health of entities of that type. Access vital metrics when you group entities by entity type in the Infrastructure Overview. For more information, see Investigate vital metrics for an entity type in the User Manual.

All default entity types in your environment will have vital metrics added to them upon upgrade, even if you've already edited them.

Splunk Infrastructure Monitoring entity integration Leverage ITSI's monitoring tools to investigate and troubleshoot your Splunk Infrastructure Monitoring cloud instances (AWS, Azure, and GCP). The integration includes an ITSI content pack containing entity discovery searches, correlation searches, and KPIs to monitor critical functions. For more information, see About the Splunk Infrastructure Monitoring entity integration in ITSI in the Entity Integrations manual.
Last modified on 14 December, 2021
Fixed issues in Splunk IT Service Intelligence

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.7.0, 4.7.1, 4.7.2, 4.7.3, 4.7.4

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters