How to make ITSI correlation searches aware of entity maintenance window status

Applicability

Splunk ITSI

Description

One potential "maintenance window" use case that is not covered out-of-the-box is for stopping the notable events from being generated by the ITSI correlation searches. Since this is not a built-in feature, it is not something you can do by flicking a switch. Rather you need to modify the correlation search(es) such way that they are aware of the entities' maintenance window status.

An entity may be shut down during maintenance and generate false alerts. It is an ITSI Administrator's job to turn on maintenance window for this entity before shutting it down, and turn it off when the entity is up again.

Based on that notion, we can modify the correlation search(es) to check the entities' maintenance window status and stop them from creating notable events as long as the maintenance window is active.

One challenge for this approach is the fact that an entity name may come in various forms: short name, FQDN, upper case, lower case, IP address and so on. We need to be able to standardize the name regardless of the naming format. 

Below SPL is an example that can do that. Please note that the maintenance window status is tracked inside the operative_maintenance_log lookup, hence the sub-search. The first 2 lines are just example to generate test events.
 

index=eventgen sourcetype=testeventgen host=brrc*
| head 5
| eval host_type = if(match(host, "^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$"), "ip_address", "hostname")
| eval host=if(host_type="hostname",lower(mvindex(split(host,"."),0) ),host)
| eval maintenance = 0
| join host type=outer
[| inputlookup operative_maintenance_log
| lookup itsi_entities _key as maintenance_object_key OUTPUT title as host
| eval host_type = if(match(host, "^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$"), "ip_address", "hostname")
| eval host=if(host_type="hostname",lower(mvindex(split(host,"."),0) ),host)
| eval maintenance = 1
| fields host, maintenance]
| where maintenance=0

NOTE: We strongly recommend to make a backup of your ITSI before modifying your correlation searches. 
 

Related Links

Splunk Documentation:
Overview of maintenance windows in ITSI
 

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release