Splunk® IT Service Intelligence

Event Analytics Manual

Acrobat logo Download manual as PDF

This documentation does not apply to the most recent version of Splunk® IT Service Intelligence. Click here for the latest version.
Acrobat logo Download topic as PDF

Overview of episode management in ITSI

The Episode Review dashboard in IT Service Intelligence (ITSI) enables organizations to manage communications related to major business issues or incidents. Episode Review allows incident communications administrators to bring together all involved users during these episodes and establish quick and easy communication within the group.

For example, a major issue occurs in a server room, which leads to a high-priority incident being raised. The episode can potentially impact all users, so it's important to bring together key representatives to communicate quickly and effectively. Episode Review can facilitate this communication process and help resolve the source issue.

The goal of Episode Review is to restore normal service operation while minimizing impact to business operations and maintaining quality. The dashboard displays a unified view of all your service-impacting alerts as episodes in their current state.

ITSI Episode Review supports the episode management process in the following ways:

  • Classify episodes by impact and urgency to prioritize work.
  • Assign to appropriate users for quick resolution.
  • Escalate as necessary for further investigation.
  • Resolve the episode and notify the user who logged it.

Any user can assign an episode to themselves and track it through the entire episode lifecycle until a service is restored and the issue is resolved.


What's an episode?

An episode represents a disruption of service operation causing impact to business operations. It's a deduplicated group of events occurring as part of a larger sequence, or an incident or period considered in isolation.

Examples of application-level episodes could be service unavailability, a data issue, an application bug, or disk-usage threshold exceeded. Examples of hardware episodes include server issues, network issues, or system issues. The Episode Review dashboard is designed to separate and organize these issues in your IT environment so that analysts can effectively triage, investigate, escalate, and resolve them.

Episodes are generated through notable event aggregation policies. Aggregation policies group similar or related notable events into episodes based on the filtering criteria you define. For more information about configuring aggregation policies, see Overview of aggregation policies in ITSI.

Lifecycle of an episode

Episode Review is responsible for managing the life cycle of episodes from creation to closure. The episode management process has several statuses, each of which is important to the success of the process and the quality of service delivered.

An episode can have the following default statuses:

Status Description
Unassigned Used by ITSI when an error prevents the episode from having a valid status assignment.
New Default status. The episode is logged but has not been triaged.
In Progress The episode is assigned and the owner is investigating the issue.
Pending The responsibility for the episode shifts temporarily to another entity to provide further information, evidence, or a resolution. An action must occur before the episode can be closed.
Resolved The owner has addressed the cause of the episode and is waiting for verification. A satisfactory fix is provided to ensure it doesn't occur again.
Closed It's confirmed that the episode is satisfactorily resolved.

See also

For information about how analysts can leverage Episode Review, including the process of triaging, investigating, and taking action on episodes, see Overview of Episode Review in ITSI in the ITSI User Manual.

Last modified on 04 January, 2021
Group similar events with Smart Mode in ITSI
Customize Episode Review in ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.5.0 Cloud only, 4.5.1 Cloud only, 4.6.0 Cloud only, 4.6.1 Cloud only, 4.6.2 Cloud only, 4.7.0, 4.7.1, 4.7.2, 4.7.3, 4.7.4

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters