Splunk® IT Service Intelligence

Release Notes

Acrobat logo Download manual as PDF


This documentation does not apply to the most recent version of ITSI. Click here for the latest version.
Acrobat logo Download topic as PDF

Known issues in Splunk IT Service Intelligence

IT Service Intelligence (ITSI) version 4.9.0 has the following known issues and workarounds.

Splunk platform issues that impact ITSI compatibility

Date filed Issue number Description
2019-02-14 SPL-155648
  • ITSI Event Analytics is incompatible with Splunk Enterprise version 7.2.0 - 7.2.3.
  • On versions 7.2.4 - 7.2.10, Event Analytics might duplicate events. To work around this issue, create a limits.conf file on all search heads at $SPLUNK_HOME/etc/apps/SA-ITOA/local/ and add the following stanza:
[search]
phased_execution_mode = auto
  • If you do not plan on using ITSI's Event Analytics functionality, the above does not apply.

See Splunk Enterprise system requirement in the Install and Upgrade Splunk IT Service Intelligence manual.

Backup/Restore and Migration Issues

Date filed Issue number Description
2021-03-31 ITSI-15182 You can view premium objects on the partial backup details view page in IT Essentials Work.
2019-07-24 ITSI-3836 Objects such as service analyzers, glass tables, and deep dives are missing after upgrade.

Workaround:
If some objects are missing from the UI or unaccessible after you upgrade, the ACL objects corresponding to the objects might be missing or corrupted. For troubleshooting steps, see https://docs.splunk.com/Documentation/ITSI/latest/Install/Troubleshoot.

Bulk Import

Date filed Issue number Description
2020-02-05 ITSI-5623 KPI searches run into memory limits when trying to reconstruct entity filter causing fewer entities to be used than expected

Workaround:
Workaround is to increase memory limits for mvcombine and mvexpand splunk search commands. Default for both commands is set at 500, example is to double memory limit.
# Make an update to $SPLUNK_HOME/etc/system/local/limits.conf
# add the following stanzas:

[mvcombine]

max_mem_usage_mb = 1000

[mvexpand]

max_mem_usage_mb = 1000

 

Notable Events

Date filed Issue number Description
2021-06-02 ITSI-17118 Rules engine fails to search returning an HTTP 404 error.
2021-04-20 ITSI-15699 Episodes are breaking every 60 seconds with a 90 second pause breaking criteria

Glass Table

Date filed Issue number Description
2021-05-13 ITSI-16623 Custom background color settings for single value widgets do not save in beta glass tables after upgrading to ITSI 4.9.0.

Workaround:
Some beta glass tables also fail to open after upgrading to ITSI 4.9.0, showing the error "Cannot read property 'title' of undefined".

None at this time.

2021-05-06 ITSI-16397 Service Analyzer and Glass Tables won't load if user does not have a time zone preference set.

Workaround:
Select a *Time zone* that is not the default time zone in your *Preferences* settings.
2021-04-20 ITSI-15691 After upgrading from the classic glass table, sparklines on single value widgets don't appear or the text overlaps with KPI visualizations due to unexpected "N/A" search values.

KPI Base Searches

Date filed Issue number Description
2021-04-01 ITSI-15224 ITSI entities with an alias containing an "=" do not get included in KPI base search results

Service Analyzer

Date filed Issue number Description
2021-05-06 ITSI-16397 Service Analyzer and Glass Tables won't load if user does not have a time zone preference set.

Workaround:
Select a *Time zone* that is not the default time zone in your *Preferences* settings.

Splunk App for Infrastructure Integration

Date filed Issue number Description
2021-05-11 ITSI-16544 Conflict : SAI Perfmon Windows data collection fails with ITSI & ITE-Work 4.9.*

Workaround:
See summary

Uncategorized issues

Date filed Issue number Description
2021-06-03 ITSI-17134 Create Maintenance Window wizard is not accepting custom time set and throws the error, "Start/End time date is invalid"

Workaround:
Workaround:

After setting the Start Time to what you want, change the start date to another date, and then change it back to the date that you want. Doing this clears the error, and you can proceed by clicking <bold>Next</bold>.

2021-05-18 ITSI-16793 On Entity detail view an surfaces for any entity type - "Cannot read property `status` of undefined"
2021-05-14 ITSI-16650 Usernames with special characters cause multiple pages to not load in ITSI 4.9.0.

Workaround:
Rename the user by removing any special characters (such as the @ sign, or any other special characters that require encoding in a URL parameter).

Users with special characters in their name (example: foo@bar.com) see an error while loading the Service Analyzer, Deep Dive, or Glass Table lister pages using the default filter All.

The error can be dismissed and you can successfully load these pages if using the filter App. The error will also fire if using the filter Private. Unfortunately, there is currently no way to see the private objects.

 

2021-03-26 ITSI-15084 Unable to reinstall the same content pack objects after adding a prefix.

Workaround:
When you install content pack objects again and add a prefix, do not select the Install as new option. Reinstalling your objects with a new prefix will add a prefix to existing objects and simply update object titles. At this time there is no alternate option to re-install existing objects as new objects. 
2021-03-25 ITSI-15067 After deleting all knowledge objects included in a content pack, the green check mark still displays on the content pack tile.
2021-03-25 ITSI-15064 Knowledge objects with the same name as objects in content packs cause conflicts when installing content pack objects.

Workaround:
Ensure that any knowledge objects (for example: services, glass tables, KPIs) that you create manually have different names than the knowledge objects included in content packs. Duplicate names will prevent content pack objects from being properly installed. 
2021-03-24 ITSI-15026 During a fresh install, because of a race conditions, entities discovered before entity types are loaded in may have no entity type association, or be duplicate with different entity_types

Workaround:
Don't enable entity discovery saved searches before pre-packaged entity types are loaded in.

Or to clean up later, remove the incomplete duplicate entities, and let the automatic import recreate valid ones.

2021-03-08 ITSI-14307 Alerts Dashboard - alert model is not working properly in alert summary table
2021-02-23 ITSI-14414 ITSI internal licenses remove customer's Dev-Test licenses since dev-test licenses cannot stack with other license types

Workaround:
* Disable itsi_license_checker_unbundle input
* Re-install Dev/Test licenses
* Restart splunk
* Keep license_checker_unbundle modular input disabled while Dev/Test license is being used
** Warn customer that without internal license, they may see increased indexing usage on their Dev/Test license

All ITSI Modules

Publication date Issue number Description
2017-03-21 ITOA-7585 When you bulk add services and an error caused by the racing condition occurs, the incorrect message "itsi_module does not exist" is displayed.
2017-03-07 MOD-979 KPIs do not have consistent backfill settings across all modules.
2017-01-17 MOD-452 The Analyze KPI button on the Service Details page is broken.
2017-01-17 MOD-402 The Export to PDF option does not work in the drilldown to a module.
2017-01-17 MOD-296 The extendable tab XML generator REST endpoint is located in DA-ITSI-OS instead of in common components where it can be used by all modules.
2017-01-17 MOD-591 ITSI displays a misleading error message when a KPI template contains a field that cannot be resolved.
2017-01-17 MOD-498 There is no upper limit to the number of characters a KPI title or description can contain. Long strings can negatively affect performance.
2017-01-17 MOD-309 The Gruntfile.js included in ITSI modules uses double quotes instead of single quotes, which does not conform to the standard for all JavaScript files.
2017-04-17 MOD-2002 When you drilldown from the Events tab, an "Invalid earliest_time" error occurs.


Workaround:
Disable drilldown from the Events tab.

2017-01-17 MOD-439 Some modules do not have descriptions for saved searches.

Application Server Module

Publication date Issue number Description
2017-01-27 MOD-492 If you reuse the same panel within a dashboard, the duplicate panel does not display any event data.

Cloud Services Module

There are no known issues for this release.

Database Module

Publication date Issue number Description
2017-01-17 MOD-586 When a lookup is not configured for TA-Microsoft-SqlServer, ITSI displays a misleading error message on the server drilldown page.

End User Experience Module

There are no known issues for this release.

Load Balancer Module

Publication date Issue number Description
2017-01-27 MOD-492 If you reuse the same panel within a dashboard, the duplicate panel does not display any event data.

Operating System Module

Publication date Issue number Description
2017-04-13 MOD-555 The Storage Free Space % base search runs every minute while the Linux df command runs every 5 minutes. This causes data gaps.
2017-04-10 MOD-1964 Windows data for memory free space is collected at different intervals than the Memory Free % KPI.
2017-01-17 MOD-1398 Line, stack, and area charts do not display a metric gap when no metrics are available during a time period.

Storage Module

There are no known issues for this release.

Virtualization Module

There are no known issues for this release.

Web Server Module

Publication date Issue number Description
2017-03-17 MOD-320 Some KPI ad hoc searches transform data with the stats command and do not retain time fields. The KPIs do not render anything and do not show thresholding details.
2017-03-17 MOD-538 When you add a new tab with panels and refresh the page, the page breaks.
Last modified on 16 June, 2021
PREVIOUS
Fixed issues in Splunk IT Service Intelligence
  NEXT
Removed features in Splunk IT Service Intelligence

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.9.0


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters