ITSI - Error when accessing Notable Event Aggregation Policies dashboard: 'Java version installed on this search head does not support Aggregation Policies, Java version 1.8 or greater is required'

Applicability

Splunk IT Service Intelligence

Description

When you access the 'Notable Event Aggregation Policies' dashboard, the following error is present on the screen.

Java version installed on this search head does not support Aggregation Policies, 
Java version 1.8 or greater is required

Investigation

Review your Java SDK installation and how the "JAVA_HOME" variable is being defined in your environment.
Install required Java components

Check your PATH and JAVA_HOME variables output, when you are using OS user that is running Splunk

echo $JAVA_HOME
echo $PATH

If they are empty/incorrect - they are not pointing to JDK binary <JAVA_FOLDER>/jdk-11.0.9.0.4/bin, define them for that user accordingly.
For example, define them as an environment variable in /etc/environment, or as user variable in ~/.bashrc.

When needed, check your Java installation paths when you need to see where Java binary is located:

where is java
which java
ls -la <FOLDER_WHERE_JAVA_LIB_IS> | grep java

When you use systemd to start the Splunk process and the variables are not system/environment accessible, you may need to define them in the Splunkd.service config.

[Service]
(... - existing Splunkd.service config)
Environment="JAVA_HOME=<JAVA_FOLDER>/jdk-11.0.9.0.4/bin"
Environment="PATH=<JAVA_FOLDER>/jdk-11.0.9.0.4/bin:<FULL_OUTPUT_OF_CURRENT_PATH_VARIABLE>"

Resolution

The following error when accessing the notable Event Aggregation Policies dashboard can be seen:

'Java version installed on this search head does not support Aggregation Policies,
 Java version 1.8 or greater is required'

When $JAVA_HOME variable is not defined properly.
To get rid of that error, the OS user that is running Splunk needs to be able to access and use the $JAVA_HOME variable, which will point to the JDK binary.

If the error persists despite having the correct version of Java and relevant environment variables, investigate further:

• Is SA-ITSI-MetricAD app disabled?

ITSI checks the Java version by probing this endpoint: /servicesNS/-/SA-ITSI-MetricAD/metric_ad/jvm
The endpoint will not be available if the SA-ITSI-MetricAD app is disabled.

• Does the user have write_metric_ad and read_metric_ad capabilities? 

The metric_ad_admin role has both capabilities by default.
Both the itoa_admin and itoa_team_admin roles also have the capabilities by default via inheritance (from the metric_ad_admin role).
 

Related Links

Install required Java components

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release