ITSI Normalization

The following table describes field and field definitions in support of Universal Alerting in ITSI. See the details About the Content Pack for Monitoring and Alerting in Splunk ITSI Content Packs.

The key for using the column titled "Abbreviated list of example values" follows. It is relevant for TA developers and ITSI implementors such as customers, SEs, and PSEs:

  • Required: Required Fields must be included.
  • Recommended: Recommended Fields are helpful, but the Universal Correlation Search does not require them.
  • Optional: Optional Fields are available for more advanced integrations, such as providing drilldowns.
Field name Data type Description Abbreviated list of example values
app string The system, service, or application that generated the alert event. Examples include "Nagios Host", "Solarwinds", "Splunk Infra Mon". recommended for ITSI
description string The description of the alert event. Adds more detail to the signature field. recommended for ITSI
entity_name string Used for the 'Entity Lookup Field' in the Universal Correlation Search. Default is <src>. optional for ITSI
itsiDrilldownSearch string SPL to drill down into the details of this alert. Default is "index=* signature="<signature>" src="<src>". optional for ITSI
itsiDrilldownURI string External link for this alert, such as "https://bakookanet.com/alerts&alertid=1234567". optional for ITSI
itsiDrilldownWeb string Optional Name for the link included in itsiDrilldownURI. Default is "External Drilldown for <itsiNotableTitle>" optional for ITSI
itsiInclude string Boolean indicating whether this alert is automatically brought into ITSI as a Notable Event. If absent, ITSI assumes itsiInclude="true". If itsiInclude="false", ITSI does not onboard the alert. This is useful for testing or for specifically selecting which raw alerts to onboard as Notable Events. recommended for ITSI
itsi_instruction string Text or markdown instructions for a human on how to handle this type of alert; can handle a link if encoded as markdown. See https://www.markdownguide.org. optional for ITSI
itsiNotableTitle string Specifies which fields the Notable Event Title includes. Default is "<signature> - <src> (<subcomponent>)". optional for ITSI
severity_id string The numeric or vendor-specific severity indicator corresponding to the event severity.

For ITSI, severity_id is one of the following values:

1 = Info or Unknown
2 = Normal or Cleared
3 = Low
4 = Medium
5 = High
6 = Critical

required for ITSI
signature string The human-friendly title of the alert event, such as 'Device Not Responding,' 'Disk Full,' or 'CPU usage too high.' required for ITSI
src string The object that is the target, host, or object of the alert event. You can alias this field from existing fields such as src_host, src_ip, or src_name. required for ITSI
subcomponent string Sub-component object for this alert. Further defines the src field.

For example, for a "Filesystem Full" alert on "server42" for "/var":

  • signature = "Filesystem Full"
  • src = "server42"
  • subcomponent = "/var"

Most alerts will not have a sub-component object. However, if the alert does contain a sub-component object, you must include this field.

recommended for ITSI
vendor_severity string The original vendor-specific severity/health/status string for this alert, such as up/down/ok/normal/critical/warning/red/green/minor/major. required by ITSI