Known issues in Splunk IT Service Intelligence

This version of IT Service Intelligence (ITSI) has the following known issues and workarounds.

Entities

Date filed	Issue number	Description
2023-08-23	ITSI-31855	API entity_discovery_searches Failed to return discovery searches post upgrade Workaround: Once all the discovery searches related to the entity ran once, this issue will not exist. If the problematic search is 'disabled' and not intended to run anymore, can utilize the clean up command to clean this search out. ([1] ) If the problematic search simply has a run time that is much further in the future, then, you can change the cron schedule and let it run sooner and then change the time back. this way, you force the search to run again so the new status format gets saved.
2023-08-14	ITSI-31723	Error modal appears when user attempts to filter entities with a parenthesis in the name on entity management page Workaround: Use backslash before the special character. To search for "myhost(" try "myhost\("

Notable Events

Date filed	Issue number	Description
2023-09-21	ITSI-32156	preview results not working while NEAP creation in windows setup
2023-08-04	ITSI-31559	The Preview Mode is not showing results when smart mode is turned on Workaround: We can replace the below Template:Itsicorrelationsearch stanza in Template:Apps/SA-ITOA/package/local/commands.conf {noformat}[itsicorrelationengine] type = custom command.arg.1=-J-Xmx8192M command.arg.2=-Dlog4j.configurationFile=../default/log4j_correlation_engine.xml command.arg.3=-J-XX:+UseG1GC command.arg.4=-DitsiCorrelationEngine.configurationFile=../default/itsi_correlation_engine.properties command.arg.5=-Dfile.encoding=UTF-8 run_in_preview = false chunked = true{noformat} and disable and enable the Template:Itsi event grouping search job ( restart the rules engine process)

Notable Event Aggregation Policies

Date filed	Issue number	Description
2023-09-21	ITSI-32156	preview results not working while NEAP creation in windows setup
2023-08-04	ITSI-31559	The Preview Mode is not showing results when smart mode is turned on Workaround: We can replace the below Template:Itsicorrelationsearch stanza in Template:Apps/SA-ITOA/package/local/commands.conf {noformat}[itsicorrelationengine] type = custom command.arg.1=-J-Xmx8192M command.arg.2=-Dlog4j.configurationFile=../default/log4j_correlation_engine.xml command.arg.3=-J-XX:+UseG1GC command.arg.4=-DitsiCorrelationEngine.configurationFile=../default/itsi_correlation_engine.properties command.arg.5=-Dfile.encoding=UTF-8 run_in_preview = false chunked = true{noformat} and disable and enable the Template:Itsi event grouping search job ( restart the rules engine process)

KPI Search Calculation

Date filed	Issue number	Description
2023-06-11	ITSI-30887	Alerts should not be generated when user run KPI generated search Manually.

Role Based Access Controls

Date filed	Issue number	Description
2023-05-04	ITSI-30017	A user in itoa_user role cannot open ITSI homeview in SHC. Workaround: We have to add the list_search_head_clustering capability to the default authorize.conf.

Uncategorized issues

Date filed	Issue number	Description
2023-09-05	ITSI-31978	Correlation search edit page malfunctions when time range set to "All Time" Workaround: *Workaround 1* From Setting-->Searches, Reports, and Alerts-->search for CS-->Edit Alert-->Update time range to Template:Last 15 Minutes from Template:All Time Workaround 2* Update/add itsi/local/savedsearches.conf as following: {noformat}dispatch.earliest_time = 0 dispatch.latest_time = now{noformat}
2023-09-04	ITSI-31923	After Changing Splunkd Custom Management Port, the Remedy Action is not working on Windows Instance
2023-09-01	ITSI-31904	In upgrade scenario, the "Entity Discovery Searches" feature does not list the discovery search identifying entity.
2023-08-02	ITSI-31555, ITSI-31464	the ITSI integration create SNOW tickets with SPL instead of INC prefix when using Episode Action with custom endpoints with ServiceNow_TA version 7.6.0 Workaround: Until bug in service now ADDON 7.6 bug (ADDON-64098 & ADDON-63502 ) are resolved, to avoid the issue, in ITSI, do not specify a custom endpoint in the action setup, keep the field empty.