ITSI MCP tools usage examples

The following examples show sample prompts, tool arguments, abbreviated responses, and direct REST validation commands for each ITSI MCP tool. Replace <episode_id>, <splunk_url>, and authentication values with values from your environment.

SA-ITOA_get_episodes

The following examples show sample prompts, tool arguments, abbreviated responses, and direct REST validation commands for each ITSI MCP tool. Replace <episode_id>, <splunk_url>, and authentication values with values from your environment.

Example prompts:

  • List active episodes.
  • Show me critical episodes from the last 24 hours.
  • Get top 10 episodes sorted by severity.
  • Any P1 episodes right now?
  • Show active episodes from the last 7 days, sorted by recency.
  • What episodes are open right now?
  • Give me sev 6 episodes only.
  • Current episode queue.

Example input:

JSON 
{ "lookback": "24h", "count": 10, "sort_by": "severity" }
JSON 
{ "lookback": "7d", "severity": "2", "count": 10, "sort_by": "recent" }

Example output (abbreviated):

JSON 
{
  "count": 2,
  "lookback": "24h",
  "severity_filter": null,
  "sort_by": "severity",
  "episodes": [
    {
      "episode_id": "d40d4034-7525-426f-89a9-3e058191a5a0",
      "title": "London - n398.dashboard.meraki.com",
      "description": "Branch\nSFO\nThousandEyes",
      "severity_code": 4,
      "severity_label": "Medium",
      "status_code": 1,
      "status_label": "New",
      "owner": "unassigned",
      "first_event_time": 1782752905,
      "last_event_time": 1782752905,
      "duration_seconds": 149,
      "event_count": 64,
      "is_active": 1,
      "itsi_policy_id": "itsi_default_policy"
    }
  ]
}

curl example:

SHELL 
curl -k -u admin \
  "https://<splunk_url>:8089/servicesNS/nobody/SA-ITOA/event_management_interface/episode_details?lookback=24h&severity=4&sort_by=recent&count=25"

SA-ITOA_get_episode_details

Example prompts:

  • Get details for episode <episode_id>.
  • What is the status of episode <episode_id>?
  • Who owns episode <episode_id>?
  • When did episode <episode_id> start and how long has it been open?
  • Show me the runbook instructions for episode <episode_id>.
  • Is episode <episode_id> still active?
  • What policy triggered episode <episode_id>?

Example input:

JSON 
{ "episode_id": "72497b10-bf58-4d10-820a-2753e21e0283" }

Example output:

JSON 
{
  "episode_id": "76b1ebc7-63e0-4677-800f-94cbf7b2ced3",
  "title": "High CPU on web-prod-01",
  "description": "CPU utilization exceeded threshold",
  "start_time": 1775140901.075,
  "last_time": 1775141800.807,
  "duration_seconds": 899,
  "duration_display": "14 minutes, 59 seconds",
  "event_count": 10000,
  "is_active": 0,
  "itsi_policy_id": "itsi_default_policy",
  "severity_code": 4,
  "severity_label": "High",
  "status_code": 1,
  "status_label": "New",
  "owner": "unassigned",
  "instruction": "null",
  "create_time": null,
  "mod_time": 1775142120.412
}

curl example:

SHELL 
curl -k -u admin \
  "https://<splunk_url>:8089/servicesNS/nobody/SA-ITOA/event_management_interface/episode_details/<episode_id>"

SA-ITOA_get_impacted_objects

Example prompts:

  • What services are affected by episode <episode_id>?
  • Get impacted objects for episode <episode_id>.
  • What's the blast radius for episode <episode_id>?
  • Which KPIs are down because of episode <episode_id>?
  • Show me the affected infrastructure for episode <episode_id>.
  • What's degraded due to episode <episode_id>?
  • Which hosts are showing red for episode <episode_id>?
  • What does episode <episode_id> break?

Example input:

JSON 
{ "episode_id": "72497b10-bf58-4d10-820a-2753e21e0283" }

Example output (abbreviated):

JSON 
{
  "episode_id": "2f664365-c93c-4081-9a48-c67cecde14f7",
  "impacted_services": [
    {
      "serviceid": "b837ff99-b368-4798-bfd0-ac8d24a12aa4",
      "service": "On-Prem Database",
      "health_score": "70.0",
      "sparkline": ["##__SPARKLINE__##", "0", "87.800000", "70.000000", "..."],
      "url": "/en-US/app/itsi/homeview?serviceId=b837ff99-b368-4798-bfd0-ac8d24a12aa4&earliest=-24h&latest=now&source=event-management-impact-tab-impacted-services"
    }
  ],
  "impacted_kpis": [
    {
      "kpiid": "03505bf97077db17ac0e3a21",
      "kpi": "CPU Utilization % (copy)",
      "service": "On-Prem Database",
      "serviceid": "b837ff99-b368-4798-bfd0-ac8d24a12aa4",
      "sparkline": ["##__SPARKLINE__##", "0", "58.889968", "58.785439", "..."],
      "url": "/en-US/app/itsi/homeview?serviceId=b837ff99-b368-4798-bfd0-ac8d24a12aa4&kpiId=03505bf97077db17ac0e3a21&earliest=-24h&latest=now&source=event-management-impact-tab-impacted-kpis"
    }
  ],
  "impacted_entities": []
}

curl example:

SHELL 
curl -k -u admin \
  "https://<splunk_url>:8089/servicesNS/nobody/SA-ITOA/event_management_interface/episode_details/<episode_id>/impacted_objects"

Example prompts:

  • What tickets are linked to episode <episode_id>?
  • Show external links for episode <episode_id>.
  • Get JIRA tickets for episode <episode_id>.
  • Are there any ServiceNow tickets for episode <episode_id>?
  • Show me the runbook links for episode <episode_id>.
  • What external references are linked to episode <episode_id>?

Example input:

JSON 
{ "episode_id": "72497b10-bf58-4d10-820a-2753e21e0283" }

Example output:

JSON 
{
  "episode_id": "2f664365-c93c-4081-9a48-c67cecde14f7",
  "linked_tickets": [
    {
      "_key": "a1b2c3d4e5f6a1b2c3d4e5f6",
      "_user": "admin",
      "event_id": "2f664365-c93c-4081-9a48-c67cecde14f7",
      "ticket_system": "jira",
      "tickets.ticket_id": "ITSI-1234",
      "tickets.ticket_url": "https://jira.example.com/browse/ITSI-1234",
      "itsi_policy_id": "default_itsi_policy"
    }
  ],
  "reference_links": [
    {
      "_key": "c3d4e5f6a1b2c3d4e5f6a1b2",
      "_user": "admin",
      "event_id": "2f664365-c93c-4081-9a48-c67cecde14f7",
      "object_type": "notable_event_ref_url",
      "url": "https://wiki.example.com/runbooks/database-health",
      "description": "On-Prem Database runbook",
      "itsi_policy_id": "default_itsi_policy"
    }
  ]
}

curl example:

SHELL 
curl -k -u admin \
  "https://<splunk_url>:8089/servicesNS/nobody/SA-ITOA/event_management_interface/episode_details/<episode_id>/external_links"

SA-ITOA_get_similar_episodes

Example prompts:

  • Find similar episodes to <episode_id>.
  • Has this episode happened before?
  • Is episode <episode_id> a recurring issue?
  • Show lookalikes for episode <episode_id>.
  • Are there historical matches for episode <episode_id>?
  • Is this a known pattern?
  • Find episodes with similar characteristics to <episode_id>.

Example input:

JSON 
{ "episode_id": "72497b10-bf58-4d10-820a-2753e21e0283" }

Example output (abbreviated):

JSON 
{
  "episode_id": "2f664365-c93c-4081-9a48-c67cecde14f7",
  "algorithm": "jaccard",
  "similar_episodes": [
    {
      "itsi_group_id": "2f664365-c93c-4081-9a48-c67cecde14f7",
      "title": "\"ITSI Internal Search Failed\" has been unhealthy for (3/3) most recent results",
      "similarity": "100.0",
      "similar_fields": "{\"title\":[...]}",
      "severity": "5",
      "status": "1",
      "owner": "unassigned",
      "start_time": "06/25/2026 02:02:55 AM",
      "last_time": "06/30/2026 05:39:00 PM",
      "num_episodes_in_time_range": "37566",
      "is_active": "1",
      "is_aice_enabled": "False",
      "itsi_policy_id": "itsi_default_policy",
      "related_episodes": [
        {
          "id": "2772e682-7da5-454d-af25-bd19183167fc",
          "title": "\"On-Prem Database\":\"CPU Utilization % (copy)\" is NORMAL"
        }
      ]
    }
  ]
}

curl example:

SHELL 
curl -k -u admin \
  "https://<splunk_url>:8089/servicesNS/nobody/SA-ITOA/event_management_interface/episode_details/<episode_id>/similar_episodes"

SA-ITOA_get_episode_summarization

Example prompts:

  • Summarize episode <episode_id>.
  • What does the AI say about episode <episode_id>?
  • Show me the AI-generated analysis for episode <episode_id>.
  • What are the suspected root causes for episode <episode_id>?
  • Get the RCA for episode <episode_id>.
  • Give me an overview of what happened in episode <episode_id>.

Example input:

JSON 
{ "episode_id": "72497b10-bf58-4d10-820a-2753e21e0283" }

Example output (abbreviated):

JSON 
{
  "episode_id": "2f664365-c93c-4081-9a48-c67cecde14f7",
  "status": 3,
  "created_time": 1751234567,
  "title": "Summarization for episode 2f664365-c93c-4081-9a48-c67cecde14f7",
  "summarization": {
    "title": "On-Prem Database CPU and Splunk ITSI Metrics search failures",
    "summary": "Two services are experiencing degraded health. On-Prem Database has undergone multiple CPU Utilization spikes dropping health score from 87.8 to as low as 30.0 over the past 24 hours. Concurrently, Splunk ITSI Metrics is reporting recurring ITSI Internal Search Failed alerts and elevated Index Lag (~115 seconds).",
    "impact": "On-Prem Database health score dropped to 30.0 (critical). Total of 37,566 related episodes observed in the time range.",
    "keywords": ["CPU utilization", "ITSI internal search", "index lag", "On-Prem Database", "Splunk ITSI Metrics"],
    "timeline": [
      "06/25/2026 02:02 AM — Episode opened; On-Prem Database CPU Utilization first flagged",
      "06/25/2026 — Repeated CPU spikes across multiple result windows",
      "06/30/2026 — ITSI Internal Search Failed alert fires; Index Lag elevated to ~115s",
      "06/30/2026 05:39 PM — Last recorded event"
    ],
    "suspected_root_causes": [
      {
        "title": "On-Prem Database CPU saturation",
        "description": "CPU Utilization % has been consistently above threshold across 15+ consecutive result windows.",
        "confidence_score": "high"
      }
    ],
    "steps_checked": {
      "service_health": true,
      "kpi_anomalies": true,
      "related_episodes": true,
      "entity_topology": false,
      "external_tickets": false
    },
    "links": [
      {
        "url": "/en-US/app/itsi/homeview?serviceId=b837ff99-b368-4798-bfd0-ac8d24a12aa4&earliest=-24h&latest=now",
        "description": "On-Prem Database service health view"
      }
    ]
  },
  "suspected_root_causes": [
    {
      "title": "On-Prem Database CPU saturation",
      "description": "CPU Utilization % has been consistently above threshold across 15+ consecutive result windows.",
      "confidence_score": "high"
    }
  ]
}

curl example:

SHELL 
curl -k -u admin \
  "https://<splunk_url>:8089/servicesNS/nobody/SA-ITOA/event_management_interface/episode_details/<episode_id>/summarization"

Source alignment notes

Tool Note Recommendation
SA-ITOA_get_episode_details Some reference material lists this response as an episode-list payload. The tool returns a single episode detail object. Use the single-episode response shape shown above for validation.
SA-ITOA_get_external_links Some reference material appears to reuse impacted-object endpoint details for external links. Use the /external_links endpoint and linked tickets/reference links response shape shown above.
SA-ITOA_get_episode_summarization Summarization schemas may vary depending on Event iQ Diagnose version and whether stored summaries exist. Treat the output as optional and validate against the installed ITSI version.
SA-ITOA_get_similar_episodes Raw Splunk output may serialize values such as similarity and active state as strings, while normalized API layers may return numeric or boolean values. Confirm the actual response format from the MCP tool layer in the target environment.