How itsi_notable_event_external_ticket works and the integration with ITSI and ServiceNow

Applicability

Description

In ITSI (Splunk's IT Service Intelligence), the itsi_notable_event_external_ticket lookup file references the itsi_notable_event_ticketing KV store collection. However, users may notice that the lookup file contains fewer fields than expected. This issue can cause confusion when attempting to understand the internal structure or when planning updates to the collection.

Investigation

To investigate this issue, consider the following:

• Understanding the Collection Workflow: The itsi_event_action_snow_wrapper alert action is responsible for creating or updating entries in the itsi_notable_event_ticketing KV store collection, which is referenced by the itsi_notable_event_external_ticket lookup file.
• Checking for Manual Modifications: Determine if any manual changes have been made to the lookup file or the KV store collection, as these can disrupt the internal automation process.
• Identifying Data Source: Verify if the data source for the lookup file has been correctly configured. The snowincidentalert command generates the ticket ID and URL from the ServiceNow incident.

Resolution

To resolve this issue, follow these steps:

1. Avoid Manual Changes: Do not manually update the itsi_notable_event_external_ticket lookup file. Manual modifications can disrupt internal processes and cause unexpected behavior.
2. Use Splunk API/SDK for Updates: If updates are needed, use the Splunk API or the ITSI Event Management SDK. These tools allow you to interact with the KV store without compromising the system's integrity.
3. Seek Professional Guidance: For complex issues or implementation guidance, consider reaching out to Splunk's Professional Services, Account Team, or Sales Team. They can offer expert advice on architecture design, capacity planning, or other customizations.