Known issues in Splunk IT Service Intelligence

This version of IT Service Intelligence (ITSI) has the following known issues and workarounds.

Notable Events

Date filed	Issue number	Description
2025-06-26	ITSI-40536	NATS Configuration Not Updating with SHC Membership Changes Workaround: *Known Issue to be document: Search Head Cluster (SHC) Membership Changes Do Not Update* Template:Nats-js.conf *Routes Automatically* When a Search Head (SH) is removed from a Search Head Cluster (SHC), the Template:$SPLUNK HOME/etc/apps/SA-ITOA/bin/nats/nats-js.conf file is not automatically updated to reflect this change in the NATS route configuration. Steps to Reproduce:* Remove a Search Head from the cluster using Template:Splunk remove shcluster-member. Stop Splunk on the removed Search Head (Template:Splunk stop). Perform a rolling restart of the remaining Search Heads. The removed Search Head no longer appears in the Search Head Clustering view. However, the entry for the removed Search Head remains in the Template:Nats-js.conf file under the Template:Routes section. Current Behavior:* The NATS server is designed to auto-discover new Search Heads but does not automatically remove entries for Search Heads that have been removed from the cluster. As a result, stale route entries may persist in the Template:Nats-js.conf file. Workaround:* Manually edit the Template:Nats-js.conf file on all Search Heads to remove the route entry for the removed Search Head. After making this change, reload nats configuration using command {noformat}$SPLUNK_HOME/etc/apps/SA-ITOA/bin/nats$ ./nats-server --signal reload {noformat} OR restart the NATS server on each Search Head. Example:* If your Template:Nats-js.conf contains: {noformat}"routes": [ "nats://SH1:4248", "nats://SH2:4248", "nats://SH3:4248" ] {noformat} and Template:SH2 is removed from the cluster, you must manually remove the Template:"nats://SH2:4248" entry from the Template:Routes array on all Search Heads and restart the NATS server on them. Note:* Failure to update the Template:Nats-js.conf file may result in connectivity issues or errors in NATS communication within the cluster.

Uncategorized issues

Date filed	Issue number	Description
2019-05-30	ITSI-3322	If you add a correlation search in ITSI which contains a sub-search returning into an eval, you get a message "Invalid search string: This search cannot be parsed when parse_only is set to true." Workaround: You can't use a sub-search returning into an eval in a correlation search. As a workaround, create and save a basic correlation search with all of the information you want outside of the search. Then as an admin user, go to Settings > Searches, reports, and alerts and open the correlation search you just created. Add the sub-search you were trying to add there.