Known issues in Splunk IT Service Intelligence

• Install the Splunk Machine Learning Toolkit version 5.4.2.
• Re-train all the models (Gradient Boosting Regressor, Random Forest Regressor, Linear Regression and Logistic Regression) on the services with predictive analytics.
• Delete the existing correlation searches for the trained model, or update the existing correlation search to refer to the newly trained model(s).
• If the correlation search was deleted, re-create the correlation searches and reference the newly trained model(s).

1. Go to $SPLUNK HOME/etc/apps/SA-ITOA/local/itsi rules engine.properties
2. There should be a parameter Rules_engine_feature_disabled_list in the file if not available then add this param with values as given in point-3.
3. Add the value RUN ACTION SYNC to the comma separated list of values

{noformat}rules_engine_feature_disabled_list = POLICY_EXECUTOR_ASYNC_SUB_ACTORS, POLICY_EXECUTOR_STATE_RECOVERY, SORT_NOTABLE_EVENTS, RUN_ACTION_ASYNC{noformat}

1. Restart the Itsi event grouping real time search by going to Activity → Jobs → Set filters to "All" → search Label="itsi event grouping" and then stop the job. It will restart after a couple of mins

OR

Update the action rules in the new to perform the action when Number of events in this episode is less than or equals to 2 if the action is Number of events in this episode is == 1

{noformat}[source::...(/|\\)var(/|\\)log(/|\\)splunk(/|\\)itsi*] TIME_PREFIX=^ TIME_FORMAT=%Y-%m-%d %H:%M:%S,%3N%z LINE_BREAKER =([\r\n]+)\d{4}-\d{2}-\d{2}\s SHOULD_LINEMERGE = false TRUNCATE = 100000 MAX_TIMESTAMP_LOOKAHEAD = 29 sourcetype = itsi_internal_log EXTRACT-component = ^[^\[\n]*\[(?P<component>[^\]]+) EXTRACT-sub_component = ^[^\]\n]*\]\s+\[(?P<sub_component>[^:\]]+) EXTRACT-log_level = ^[^\[\n]*\s+(?P<log_level>(?:\w+))\s+\[{noformat}

1. In order to manually remove the local storage, go to *Chrome Developer Tools,* then *Applications*, then *Local Storage* and delete the key splunk-appnav:itsi:admin:en-GB.