Group alerts from the Splunk App for Infrastructure in ITSI

ITSI includes a pre-built notable event aggregation policy called Normalized Policy (Splunk App for Infrastructure) that groups the notable events created for Splunk App for Infrastructure (SAI) alerts into episodes. If the Normalized Correlation Search is enabled, this policy also groups notable events for other third-party alerts that use ITSI normalized fields. You can modify the aggregation policy to meet your specific needs.

The aggregation policy groups notable events created from the following correlation searches:

• Splunk App for Infrastructure Alerts
• Normalized Correlation Search

Enable the Normalized Policy (Splunk App for Infrastructure)

If you enable alert integration in the Integrate with Splunk App for Infrastructure dialog, the Normalized Policy (Splunk App for Infrastructure) aggregation policy is automatically enabled, along with the Splunk App for Infrastructure Alerts correlation search. If you enabled the correlation search directly, you need to manually enable the aggregation policy to use it.

To enable the SAI aggregation policy, perform the following steps:

1. From the ITSI main menu, click Configuration > Notable Event Aggregation Policies.
2. Locate the policy called Normalized Policy (Splunk App for Infrastructure).
3. Change the status to Enabled.

Normalized Policy (Splunk App for Infrastructure) configuration

The Normalized Policy (Splunk App for Infrastructure) aggregation policy has the following configuration:

Setting	Description
Include the events if	Events are filtered by the following ITSI normalized fields: itsiAlert itsiInstance itsiSubInstance itsiSeverity
Split events by field	Events are split into multiple episodes by: itsiAlert itsiInstance itsiSubInstance
Break episode	The episode is broken: If the flow of events into the episode is paused for 3600 seconds (1 hour) OR If an event occurs for which severity = Normal.
Episode information	Episode Title: Normalized Alert for %itsiInstance% (%itsiSubInstance%) : %itsiAlert% Episode Description: Same as last event Episode Severity: Same as last event Episode Assignee: Same as first event Episode Status: Same as first event
Action Rules	If the episode is broken, and the number of events in this episode is == 1, then change status to Closed for the episode. If the episode is broken, and the number of events in this episode is >= 2, then change status to Resolved for the episode.

How the aggregation policy works

If the first event in the episode has a severity of Normal, the episode breaks and no other events are added to it. If there is only one event in the episode, the status changes to Closed.

If two or more events are added to an episode with a severity other than Normal, and then a Normal event comes in (a clearing event):

• The episode breaks.
• The severity is set to Normal.
• The status changes to Resolved.

If an episode contains events with a severity other than Normal:

• The episode breaks if no new events come in for an hour.
• The severity is set to the same as the last event.
• The status changes to Resolved because enough time has passed that a problem most likely no longer exists.

This aggregation policy lets you filter Episode Review by Status to get the following information:

Status	Description
New	Alerts that are active (the most recent severity is not Normal).
Resolved	Alerts that are no longer active (the most recent severity is Normal or no new events have been received for an hour).
Closed	Alerts that can be ignored since they were only Normal.

See Overview of Episode Review in ITSI for information about Episode Review.