Release notes for the Content Pack for Monitoring and Alerting
This version of the Content Pack for Monitoring and Alerting was released on April 23, 2021. The following sections describe the contents of the current release. Each content pack is meant to be installed once. Don't install newer versions of a content pack on top of an existing version. If you want specific content from a newer version, upload the content pack to a temporary instance and copy the objects you want to your environment.
The following table describes the contents of
|New feature or enhancement||Description|
|Aggregation policies||The following aggregation policies:
|Universal Alerting correlation search||The Universal Correlation Search onboards external alerts that adhere to the Universal Alerting Normalization Standard. For more information, see About Universal Alerting. Besides converting external alerts to notable events, the UCS also performs alarm state deduplication over the last hour of raw alerts, as well as backfill over the last hour to find "missed" alerts.
|Episode monitoring correlation searches||The following searches that monitor the episodes in your environment:
|Service monitoring correlation searches||The following searches that monitor the services and KPIs in your environment:
|Sample services||The following sample services:
|Saved searches||The following saved searches:
|Automatic lookups||The following automatic lookups:
|Dashboards||The following dashboards:
|Saved Episode Review views||The following saved Episode Review dashboards:
Significant and non-passive changes
This version of the content pack contains some significant and non-passive changes from prior versions.
Episode monitoring correlation searches
- The correlation search "All Services and KPIs Return to Normal" has been deprecated and replaced by Episode Monitoring - Set Episode to Highest Alarm Severity.
- Alert suppression logic has been non-passively changed. When multiple episode monitoring correlation searches are enabled, you receive one notable event for each enabled episode monitoring alert, which triggers on the episode. In previous versions of the content pack, the episode would receive only one episode monitoring alert, which was the first detection that triggered. For more information on this behavior, see Alert action throttling and configuration.
Service monitoring correlation searches
- Most correlation search logic has been moved to a macro for readability and reuse. A new macro
add_universal_alert_fields_to_notablecontains most of the logic to create fields on a service monitoring notable event. This macro increases correlation search readability and allows you to modify common notable event fields centrally, in the rare instance when you must modify macro logic. The macro also contains extensive inline documentation for readibility.
- Notable event identifier fields have been updated. The notable event identifier fields for service monitoring notables has been changed to a stronger naming convention and has moved to the macro
add_itsi_service_monitoring_ne_identifier_stringto allow customization. For more information, see Episode timeline event type configuration.
- Notable events comply with the universal alerting common information model (CIM). For more information, see Common Information Model - ITSI Normalization or About Universal Alerting in the Content Pack for Monitoring and Alerting.
Universal Alerting correlation search
This version of the content pack contains a new Universal correlation search to capture and process raw external alerts from monitoring sources such as Nagios or Solarwinds, which are normalized using the Universal Alerting Field Standard. For more information, see About Universal Alerting.
Saved episode views
- Four new episode views are included to support episode management workflows.
- The views "Episode by Alert Group" are replaced by the new episode views.
The following changes apply to all of the aggregation policies shipped in the content pack.
- Episode title change: The episode title uses stronger naming conventions. This change affects any logic i the content pack that uses episode title to correlate current episodes with historical ones, such as the "Episode Monitoring - Episode Risk Well Above Historical Average" correlation search.
- Episode severity change: The episode severity updates to reflect the severity of the most recent notable event in the episode. This change produces more accurate episode severity levels when you use it in conjunction with the new "Episode Monitoring - Set Episode to Highest Alarm Severity" correlation search.
- Episode breaking change: In the previous version of the content pack, episodes were configured to forcibly break after existing for 24 hours. In this release, episodes break when they receive no new activity in 8 hours, or if the episode severity returns to normal when using the "Episode Monitoring - Set Episode to Highest Alarm Severity" correlation search.
About the Content Pack for Monitoring and Alerting
Install and configure the Content Pack for Monitoring and Alerting
This documentation applies to the following versions of Splunk® Content Packs for ITSI and IT Essentials Work: current