Known issues in Splunk IT Service Intelligence

This version of IT Service Intelligence (ITSI) has the following known issues and workarounds.

Adaptive Thresholding

Date filed	Issue number	Description
2024-04-12	ITSI-35070	On few KPIs using adaptive threshold, the results from the scheduled overnight run seem very different from the preview adaptive threshold results Workaround: Clone the KPI and backfill it for required time span and enable the AT.

Notable Events

Date filed	Issue number	Description
2024-06-20	ITSI-36397	Actions are not performed if the event is breaking the episode based on the timebased criteria and grouping into a new group. Workaround: Reset Template:Policy rules check frequency delay to 60000 under Template:$SPLUNK HOME/etc/apps/SA-ITOA/local/itsi rules engine.properties OR Update the action rules in the new to perform the action when Template:Number of events in this episode is less than or equals to 2 if the action is Template:Number of events in this episode is == 1

KPI Search Calculation

Date filed	Issue number	Description
2024-06-05	ITSI-35981	Time based threshold policies are not working for the entities.

Uncategorized issues

Date filed	Issue number	Description
2024-06-06	ITSI-36019	Discrepancy in time in the user_access_interface.log file
2024-05-31	ITSI-35922	events from source itsi_appserver.log are way longer than new increased TRUNCATE limit Workaround: Copy the below stanza in Template:Apps/SA-ITOA/package/local/props.conf from Template:Apps/SA-ITOA/package/default/props.conf and increased TRUNCATE value with Template:200000. {noformat}[source::...(/|\\)var(/|\\)log(/|\\)splunk(/|\\)itsi*] TIME_PREFIX=^ TIME_FORMAT=%Y-%m-%d %H:%M:%S,%3N%z LINE_BREAKER =([\r\n]+)\d{4}-\d{2}-\d{2}\s SHOULD_LINEMERGE = false TRUNCATE = 100000 MAX_TIMESTAMP_LOOKAHEAD = 29 sourcetype = itsi_internal_log EXTRACT-component = ^[^\[\n]*\[(?P<component>[^\]]+) EXTRACT-sub_component = ^[^\]\n]*\]\s+\[(?P<sub_component>[^:\]]+) EXTRACT-log_level = ^[^\[\n]*\s+(?P<log_level>(?:\w+))\s+\[{noformat}
2024-05-21	ITSI-35776	As an itoa_admin, when upgrading ITE-W to ITSI and then downgrading the app label still says IT Essentials Work Workaround: h3. Workaround for the user: The cache will be automatically cleared after 24 hours in this case the issue will be automatically resolved. Manually remove the local storage by going to the {{Chrome Developer Tools -> Applications -> Local Storage}} and delete the key Template:Splunk-appnav:itsi:admin:en-GB.
2024-05-09	ITSI-35608	Getting new lines before and after every line of CSV when downloading it on windows instance
2024-05-08	ITSI-35592	Deleting associated service template from a service in the service sandbox does not update the linked service template count.
2024-04-26	ITSI-35428	Customer wants to know whether Index references needs to be changed in scripts for default ITSI indexes.
2023-12-22	ITSI-33539	Closing an Episode when Rules Engine is disabled does not break the Episode