Splunk® IT Service Intelligence

Release Notes

Acrobat logo Download manual as PDF


This documentation does not apply to the most recent version of ITSI. Click here for the latest version.
Acrobat logo Download topic as PDF

Known issues in Splunk IT Service Intelligence

IT Service Intelligence (ITSI) version 4.9.1 has the following known issues and workarounds.

Splunk platform issues that impact ITSI compatibility

Date filed Issue number Description
2019-02-14 SPL-155648
  • ITSI Event Analytics is incompatible with Splunk Enterprise version 7.2.0 - 7.2.3.
  • On versions 7.2.4 - 7.2.10, Event Analytics might duplicate events. To work around this issue, create a limits.conf file on all search heads at $SPLUNK_HOME/etc/apps/SA-ITOA/local/ and add the following stanza:
[search]
phased_execution_mode = auto
  • If you do not plan on using ITSI's Event Analytics functionality, the above does not apply.

See Splunk Enterprise system requirement in the Install and Upgrade Splunk IT Service Intelligence manual.

Bulk Import

Date filed Issue number Description
2021-07-03 ITSI-17629, ITSI-17628 Entity Import: Recurring import saved with "role" instead of user name for 'Owner'
2021-06-09 ITSI-17178 Some ITSI Import Objects saved searches fail to merge entities with the host field and may create duplicate entities.

Workaround:
# Disable ITSI Import Objects - VMware VM.
  1. Copy the ITSI Import Objects - VMware VM saved search, but change the entity_merge_field attribute to host.
  1. Enable the updated ITSI Import Objects - VMware VM search.

Notable Events

Date filed Issue number Description
2021-07-15 ITSI-17809 After ITSI upgrade from 4.6.1 to 4.9.1, new episodes are created instead of events being added to existing episodes.

Workaround:
Add the policy_id in the field_list for the itsi_notable_group_system_lookup stanza in $SPLUNK_HOME/etc/apps/SA-ITOA/transforms.conf
2021-05-24 ITSI-16844 For time-based policies, Action Rules with the condition AND "the following event occurs" don't work.
2021-01-21 ITSI-13167 On Safari, there is a 10 to 15 second delay when editing a Notable Event Aggregation Policy using the ServiceNow action.

Notable Event Aggregation Policies

Date filed Issue number Description
2021-07-15 ITSI-17809 After ITSI upgrade from 4.6.1 to 4.9.1, new episodes are created instead of events being added to existing episodes.

Workaround:
Add the policy_id in the field_list for the itsi_notable_group_system_lookup stanza in $SPLUNK_HOME/etc/apps/SA-ITOA/transforms.conf
2021-05-24 ITSI-16844 For time-based policies, Action Rules with the condition AND "the following event occurs" don't work.
2021-01-21 ITSI-13167 On Safari, there is a 10 to 15 second delay when editing a Notable Event Aggregation Policy using the ServiceNow action.

Glass Table

Date filed Issue number Description
2021-08-13 ITSI-18306 when using service swapping, it displays "Service not found" when the service is not included in the first 100 services
2021-05-13 ITSI-16623 Custom background color settings for single value widgets do not save in beta glass tables after upgrading to ITSI 4.9.0.

Workaround:
Some beta glass tables also fail to open after upgrading to ITSI 4.9.0, showing the error "Cannot read property 'title' of undefined".

None at this time.

2021-05-06 ITSI-16397 Service Analyzer and Glass Tables won't load if user does not have a time zone preference set.

Workaround:
Select a *Time zone* that is not the default time zone in your *Preferences* settings.

Maintenance Window

Date filed Issue number Description
2021-06-03 ITSI-17134 Create Maintenance Window wizard is not accepting custom time set and throws the error, "Start/End time date is invalid"

Workaround:
Workaround:

After setting the Start Time to what you want, change the start date to another date, and then change it back to the date that you want. Doing this clears the error, and you can proceed by clicking <bold>Next</bold>.

Service Analyzer

Date filed Issue number Description
2021-05-06 ITSI-16397 Service Analyzer and Glass Tables won't load if user does not have a time zone preference set.

Workaround:
Select a *Time zone* that is not the default time zone in your *Preferences* settings.

Splunk App for Infrastructure Integration

Date filed Issue number Description
2021-05-11 ITSI-16544 Conflict : SAI Perfmon Windows data collection fails with ITSI & ITE-Work 4.9.*

Workaround:
h3. Workaround : disable the transforms / sourcetypes in one of the version

On the servers parsing the data (indexers or HWF or SH), comment out the following lines in Splunk_TA_Infrastructure/default/props.conf for all the PerfmonMetrics:* sourcetypes.

 example for the first one 

#commented for bug ITSI-16544 SAI-ITSI conflict
  1. For SAI Windows Metrics
#[PerfmonMetrics:CPU]
#TRANSFORMS-_fields_for_perfmon_metrics_store_sai = fields_for_perfmon_metrics_store_sai
#TRANSFORMS-_value_for_perfmon_metrics_store_sai = value_for_perfmon_metrics_store_sai
#EVAL-metric_type = "gauge"#SEDCMD-remove-whitespace = s/ /_/g s/\s/ /g

Uncategorized issues

Date filed Issue number Description
2021-07-22 ITSI-17901 After installing IT Essentials Work, receive an error of ERROR ExecProcessor - message from ""C:\Program Files\Splunk\bin\Python3.exe"
2021-05-25 ITSI-16870, ITSI-17181 Entity page doesn't load when IT Essentials Work is installed on search head cluster
2021-03-24 ITSI-15026 Entities discovered before entity types are added may have no entity type association.

Workaround:
On a reinstallation of ITSI, don't enable entity discovery saved searches before pre-packaged entity types are added to ITSI. 

All ITSI Modules

Publication date Issue number Description
2017-03-21 ITOA-7585 When you bulk add services and an error caused by the racing condition occurs, the incorrect message "itsi_module does not exist" is displayed.
2017-03-07 MOD-979 KPIs do not have consistent backfill settings across all modules.
2017-01-17 MOD-452 The Analyze KPI button on the Service Details page is broken.
2017-01-17 MOD-402 The Export to PDF option does not work in the drilldown to a module.
2017-01-17 MOD-296 The extendable tab XML generator REST endpoint is located in DA-ITSI-OS instead of in common components where it can be used by all modules.
2017-01-17 MOD-591 ITSI displays a misleading error message when a KPI template contains a field that cannot be resolved.
2017-01-17 MOD-498 There is no upper limit to the number of characters a KPI title or description can contain. Long strings can negatively affect performance.
2017-01-17 MOD-309 The Gruntfile.js included in ITSI modules uses double quotes instead of single quotes, which does not conform to the standard for all JavaScript files.
2017-04-17 MOD-2002 When you drilldown from the Events tab, an "Invalid earliest_time" error occurs.


Workaround:
Disable drilldown from the Events tab.

2017-01-17 MOD-439 Some modules do not have descriptions for saved searches.

Application Server Module

Publication date Issue number Description
2017-01-27 MOD-492 If you reuse the same panel within a dashboard, the duplicate panel does not display any event data.

Cloud Services Module

There are no known issues for this release.

Database Module

Publication date Issue number Description
2017-01-17 MOD-586 When a lookup is not configured for TA-Microsoft-SqlServer, ITSI displays a misleading error message on the server drilldown page.

End User Experience Module

There are no known issues for this release.

Load Balancer Module

Publication date Issue number Description
2017-01-27 MOD-492 If you reuse the same panel within a dashboard, the duplicate panel does not display any event data.

Operating System Module

Publication date Issue number Description
2017-04-13 MOD-555 The Storage Free Space % base search runs every minute while the Linux df command runs every 5 minutes. This causes data gaps.
2017-04-10 MOD-1964 Windows data for memory free space is collected at different intervals than the Memory Free % KPI.
2017-01-17 MOD-1398 Line, stack, and area charts do not display a metric gap when no metrics are available during a time period.

Storage Module

There are no known issues for this release.

Virtualization Module

There are no known issues for this release.

Web Server Module

Publication date Issue number Description
2017-03-17 MOD-320 Some KPI ad hoc searches transform data with the stats command and do not retain time fields. The KPIs do not render anything and do not show thresholding details.
2017-03-17 MOD-538 When you add a new tab with panels and refresh the page, the page breaks.
Last modified on 15 September, 2021
PREVIOUS
Fixed issues in Splunk IT Service Intelligence
  NEXT
Removed features in Splunk IT Service Intelligence

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.9.1


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters