Known issues in Splunk IT Service Intelligence

1. Go to $SPLUNK HOME/etc/apps/SA-ITOA/local/itsi rules engine.properties
2. There should be a parameter Rules_engine_feature_disabled_list in the file if not available then add this param with values as given in point-3.
3. Add the value RUN ACTION SYNC to the comma separated list of values

{noformat}rules_engine_feature_disabled_list = POLICY_EXECUTOR_ASYNC_SUB_ACTORS, POLICY_EXECUTOR_STATE_RECOVERY, SORT_NOTABLE_EVENTS, RUN_ACTION_ASYNC{noformat}

1. Restart the Itsi event grouping real time search by going to Activity → Jobs → Set filters to "All" → search Label="itsi event grouping" and then stop the job. It will restart after a couple of mins

OR

Update the action rules in the new to perform the action when Number of events in this episode is less than or equals to 2 if the action is Number of events in this episode is == 1

1. Go to $SPLUNK HOME/etc/apps/SA-ITOA/local/itsi rules engine.properties
2. There should be a parameter Rules engine feature disabled list in the file if not available then add this param with values as given in point-3.
3. Add the value RUN ACTION ASYNC to the comma separated list of values

{noformat}rules_engine_feature_disabled_list = POLICY_EXECUTOR_ASYNC_SUB_ACTORS, POLICY_EXECUTOR_STATE_RECOVERY, SORT_NOTABLE_EVENTS, RUN_ACTION_ASYNC{noformat}

1. Restart the Itsi event grouping real time search by going to Activity → Jobs → Set filters to "All" → search Label="itsi event grouping" and then stop the job. It will restart after a couple of mins

OR

Update the action rules in the new to perform the action when Number of events in this episode is less than or equals to 2 if the action is Number of events in this episode is == 1

1. 1. With an admin user, go to {{https://<URL>:8000/en-US/manager/permissions/itsi/data/ui/views/service_definition?manager_cancel_url=%2Fmanager%2Fitsi%2Fdata%2Fui%2Fviews%3Fns%3Ditsi%26app_only%3D1%26pwnr%3D-%26search%3Ddefinition%26count%3D100&uri=%2FservicesNS%2Fnobody%2Fitsi%2Fdata%2Fui%2Fviews%2Fservice_definition}}
   2. Give READ and WRITE for ITOA_ADMIN
   3. Give READ for ITOA_TEAM_ADMIN
   4. Save
   5. Refresh service analyzer page
2. Workaround from the CLI:

• SSH into the SH of the cluster.
• Go to $SPLUNK HOME/etc/apps/itsi/metadata file, and remove Local.meta file by using the command Rm -rf $SPLUNK HOME/etc/apps/itsi/metadata/local.meta .
• Restart Splunk using $SPLUNK HOME/bin/splunk restart and open ITSI.
• Go to Service Analyzer and open any service and you'll be able to see the drilldown.

{noformat}[source::...(/|\\)var(/|\\)log(/|\\)splunk(/|\\)itsi*] TIME_PREFIX=^ TIME_FORMAT=%Y-%m-%d %H:%M:%S,%3N%z LINE_BREAKER =([\r\n]+)\d{4}-\d{2}-\d{2}\s SHOULD_LINEMERGE = false TRUNCATE = 100000 MAX_TIMESTAMP_LOOKAHEAD = 29 sourcetype = itsi_internal_log EXTRACT-component = ^[^\[\n]*\[(?P<component>[^\]]+) EXTRACT-sub_component = ^[^\]\n]*\]\s+\[(?P<sub_component>[^:\]]+) EXTRACT-log_level = ^[^\[\n]*\s+(?P<log_level>(?:\w+))\s+\[{noformat}