Modify analyst permissions within Episode Review in ITSI
As a Splunk IT Service Intelligence (ITSI) administrator, you can customize the way analysts view and interact with events and episodes in Episode Review.
Modify which events analysts can see
By default, ITSI service-level permissions apply to episodes in Episode Review. This means that analysts can only see events from services for which they have read permission. If an event is not associated with a particular service (none of the fields in the event contains service information) then all users can view the event.
You can disable service-level permissions for Episode Review using the itsi_team.conf file.
- Only users with file system access, such as system administrators, can disable service-level permissions for Episode Review.
- Review the steps in How to edit a configuration file in the Admin Manual.
Never change or copy the configuration files in the default directory. The files in the default directory must remain intact and in their original location.
- Open or create an
- Under the
If teams are disabled for Episode Review, all ITSI users can see all notable events, regardless of which service they are associated with. However, service information for services that a user does not have read access to are not displayed for notable events. For information about teams, see Overview of teams in ITSI.
Configure read/write permissions
Configure read and write permissions on a saved view of Episode Review to restrict permissions for certain roles. By default, read and write permissions are granted to Everyone (all roles) for a newly created view of Episode Review.
You must have the
itoa_team_admin role, or be assigned the
configure_perms capability, to set permissions on a saved Episode Review. For more information, see Configure users and roles in ITSI.
- Within Episode Review, click the side arrow to show alternate views.
- Click Full Lister Page.
- On the Episode Review lister page, locate the saved view you want to edit and click Edit > Permissions.
- Allow or prevent analysts from reading or writing to the saved Episode Review. Everyone is granted read/write access by default.
- Click Save.
Customize Episode Review in ITSI
Customize episode statuses in ITSI
This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.5.0 Cloud only, 4.5.1 Cloud only, 4.6.0 Cloud only, 4.6.1 Cloud only, 4.6.2 Cloud only, 4.7.0, 4.7.1, 4.7.2, 4.8.0 Cloud only, 4.8.1 Cloud only, 4.9.0, 4.9.1, 4.9.2, 4.9.3, 4.10.0 Cloud only, 4.10.1 Cloud only, 4.10.2 Cloud only