![]() To set the retention time for all object types, reduce the retentionTimeInSec in the stanza.Open or create a local itsi_notable_event_nf file in $SPLUNK_HOME/etc/apps/SA-ITOA/local/.The files in the default directory must remain intact and in their original location. Never change or copy the configuration files in the default directory. Review the steps in How to edit a configuration file in the Admin Manual.Only users with file system access, such as system administrators, can set the notable event retention policy.Retention policies are based on the mod_time (modify time), not the tag creation time. The retention policy determines how long notable event metadata remains in the KV store before it is moved to itsi_notable_archive. You can tune the retention policy for notable event metadata using an ITSI configuration file. If you have a large number of events, use the ITSI Health Check dashboard to check the collection sizes on disk and decide if you need to change the retention policy. | outputlookup itsi_notable_group_system_lookup Trim collections using configuration filesīy default, notable event metadata is archived after six months to keep the KV store from growing too large. Set the status of episodes older than two days to Resolved: | inputlookup itsi_notable_group_user_lookup The following examples show different operations you can perform on KV store collections:Ĭheck the episodes in the user collection generated in the last hour: If you're adding, modifying, or deleting entries, use outputlookup to write the results to the KV store collection. To modify notable event KV store collections using SPL, use an inputlookup command to search the contents of a KV store lookup, then specify the operation to take on the lookup. You must have the admin or itoa_admin ITSI role to modify notable event KV store collections. Check the results of the search before adding the outputlookup line to make sure you're accessing the correct data.Make sure to back up the KV store before running command in case you need to revert your changes.Follow these guidelines when running the outputlookup command: If you misuse the command, Event Analytics data will be lost and the contents of Episode Review will disappear. Guidelines for running the outputlookup commandīy default the outputlookup command overwrites your entire KV store collection. However, for a more dynamic and simpler solution, consider trimming them using SPL. This file lets you individually set retention limits for different collections, thereby deleting objects that have existed longer than the retention period. If you only want to trim down notable event KV store collections without performing updates, you can do it through the itsi_notable_event_nf file. Use the inputlookup and outputlookup commands to perform CRUD operations on notable event KV store collection fields for maintenance and migration purpose without modifying configuration files. You can use SPL to repopulate or otherwise make bulk changes to the collections ITSI leverages for cached notable event state, typically referred to as the system and user lookups. IT Service Intelligence (ITSI) stores the status of notable events and episodes in KV store collections called itsi_notable_. ![]() If you need training on the Splunk platform and IT Service Intelligence, see Splunk Training and Certification.Modify notable event KV store collections in ITSI This manual is written for a user capable of installing, configuring, and administering Splunk software. Triage and investigate issues using Episode Review.Monitor the health of your services with the Service Analyzer.Use IT Service Intelligence to do the following: As issues are identified, analysts can quickly investigate and resolve them. You can capture, monitor, and report on data from devices, systems, and applications across your environment. ITSI provides visibility into your services, actionable insight into the performance of your IT operations, and features for tracking alerts. ITSI is built on the Splunk operational intelligence platform and uses the search and correlation capabilities of the platform to enable you to collect, monitor, and report on data from IT devices, systems, and applications. Splunk IT Service Intelligence (ITSI) uses the Splunk platform's searching and reporting capabilities to provide IT operations analysts with an overall view of their organization's service health.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |