Error Upgrade ITSI from 4.17.1 to 4.19 "Failed to execute operation: Update 'applyat' saved searches with batching AT searches"

Applicability

Description

This misconfiguration caused the following error



process:214603 thread:MigrationThread ERROR [itsi.migration] [itsi_migration_log:35] [error] 4.18.0 to 4.19.0: UI: Failed to execute operation: Update 'applyat' saved searches with batching AT searches.searches

stalling the upgrade.

Investigation

During the upgrade process, it was found that the "ITSI Episode Analytics" service had an associated KPI threshold template with adaptive thresholding enabled but an empty adaptive_thresholding_training_window. 

To address the issue, a curl command was executed to send a POST request to a Splunk ITSI endpoint. This command aimed to update the KPI threshold template's adaptive thresholding training window to the past 7 days. The command used was as follows: 

curl -k -u admin https://localhost:8089/servicesNS/nobody/SA-ITOA/itoa_interface/kpi_threshold_template/da-itsi-cp-monitoring-alerting-ea-storm-detection-stddev/?is_partial_data=1 -X POST -H "Content-Type:application/json" -d '{"adaptive_thresholding_training_window": "-7d"}'

Resolution

The execution of the curl command successfully updated the KPI threshold template's adaptive thresholding training window. After this adjustment, the upgrade to ITSI version 4.19 proceeded without further issues.