Impacted Services and Episodes are not visible in alerts and episodes page.
Available Languages
Applicability
Splunk IT Service Intelligence V4.17.0Description
The impacted services and KPIs are not visible while searching for an episode across "All time" on the "Alert and Episodes" page.
Investigation
In the macro itsi_event_management_similar_episodes_tickets_lookup where the impacted services/kpis are populated to alerts and episoded page the the earliest time is set to 1d.
lookup itsi_notable_event_external_ticket event_id AS itsi_group_id OUTPUT tickets.ticket_system AS ticket_system, tickets.ticket_id AS ticket_id, tickets.ticket_url AS ticket_url
| join type=left itsi_group_id
[ search index="itsi_notable_archive" object_type=external_ticket earliest=1d latest=now()
| rename event_id as itsi_group_id tickets{}.* as *_new
| table itsi_group_id *_new]
| eval ticket_system=mvappend(ticket_system, ticket_system_new), ticket_id=mvappend(ticket_id, ticket_id_new), ticket_url=mvappend(ticket_url, ticket_url_new)
| fields - *_new
| rex field=ticket_id mode=sed "s/([\r\n]+)/,/g"
| rex field=ticket_system mode=sed "s/([\r\n]+)/,/g"
| rex field=ticket_url mode=sed "s/([\r\n]+)/,/g"
| eval ticket_id=mvjoin(ticket_id, ","), ticket_system=mvjoin(ticket_system, ","), ticket_url=mvjoin(ticket_url, ",")
| makemv delim="," ticket_id
| makemv delim="," ticket_system
| makemv delim="," ticket_url
| eval linked_tickets=mvzip(ticket_system, ticket_id, ",")
| eval linked_tickets=mvzip(linked_tickets, ticket_url)
| fields - ticket_system,ticket_id, ticket_url
| join type=left itsi_group_id
[ search index="itsi_notable_archive" object_type=external_ticket earliest=1d latest=now()
| rename event_id as itsi_group_id tickets{}.* as *_new
| table itsi_group_id *_new]
| eval ticket_system=mvappend(ticket_system, ticket_system_new), ticket_id=mvappend(ticket_id, ticket_id_new), ticket_url=mvappend(ticket_url, ticket_url_new)
| fields - *_new
| rex field=ticket_id mode=sed "s/([\r\n]+)/,/g"
| rex field=ticket_system mode=sed "s/([\r\n]+)/,/g"
| rex field=ticket_url mode=sed "s/([\r\n]+)/,/g"
| eval ticket_id=mvjoin(ticket_id, ","), ticket_system=mvjoin(ticket_system, ","), ticket_url=mvjoin(ticket_url, ",")
| makemv delim="," ticket_id
| makemv delim="," ticket_system
| makemv delim="," ticket_url
| eval linked_tickets=mvzip(ticket_system, ticket_id, ",")
| eval linked_tickets=mvzip(linked_tickets, ticket_url)
| fields - ticket_system,ticket_id, ticket_url
This earliest time configuration is the cause of the issue.
Resolution
To resolve this, changes need to be made to the itsi_event_management_similar_episodes_tickets_lookup macro for the "earliest" value to "-30d"
Follow the steps below to modify the macro:
- Navigate to Settings.
- Click the Advanced Search in the Knowledge section.
- Click Search Macros.
- Search for itsi_event_management_similar_episodes_tickets_lookup macro in the filter.
- Click the itsi_event_management_similar_episodes_tickets_lookup to open the macro to edit.
- Save the changes.
Change the earliest time to -30d as shown below:
lookup itsi_notable_event_external_ticket event_id AS itsi_group_id OUTPUT tickets.ticket_system AS ticket_system, tickets.ticket_id AS ticket_id, tickets.ticket_url AS ticket_url
| join type=left itsi_group_id
[ search index="itsi_notable_archive" object_type=external_ticket earliest=-30d latest=now()
| rename event_id as itsi_group_id tickets{}.* as *_new
| table itsi_group_id *_new]
| eval ticket_system=mvappend(ticket_system, ticket_system_new), ticket_id=mvappend(ticket_id, ticket_id_new), ticket_url=mvappend(ticket_url, ticket_url_new)
| fields - *_new
| rex field=ticket_id mode=sed "s/([\r\n]+)/,/g"
| rex field=ticket_system mode=sed "s/([\r\n]+)/,/g"
| rex field=ticket_url mode=sed "s/([\r\n]+)/,/g"
| eval ticket_id=mvjoin(ticket_id, ","), ticket_system=mvjoin(ticket_system, ","), ticket_url=mvjoin(ticket_url, ",")
| makemv delim="," ticket_id
| makemv delim="," ticket_system
| makemv delim="," ticket_url
| eval linked_tickets=mvzip(ticket_system, ticket_id, ",")
| eval linked_tickets=mvzip(linked_tickets, ticket_url)
| fields - ticket_system,ticket_id, ticket_url
| join type=left itsi_group_id
[ search index="itsi_notable_archive" object_type=external_ticket earliest=-30d latest=now()
| rename event_id as itsi_group_id tickets{}.* as *_new
| table itsi_group_id *_new]
| eval ticket_system=mvappend(ticket_system, ticket_system_new), ticket_id=mvappend(ticket_id, ticket_id_new), ticket_url=mvappend(ticket_url, ticket_url_new)
| fields - *_new
| rex field=ticket_id mode=sed "s/([\r\n]+)/,/g"
| rex field=ticket_system mode=sed "s/([\r\n]+)/,/g"
| rex field=ticket_url mode=sed "s/([\r\n]+)/,/g"
| eval ticket_id=mvjoin(ticket_id, ","), ticket_system=mvjoin(ticket_system, ","), ticket_url=mvjoin(ticket_url, ",")
| makemv delim="," ticket_id
| makemv delim="," ticket_system
| makemv delim="," ticket_url
| eval linked_tickets=mvzip(ticket_system, ticket_id, ",")
| eval linked_tickets=mvzip(linked_tickets, ticket_url)
| fields - ticket_system,ticket_id, ticket_url
After the modification, the Impacted Services/KPIs were displayed for "All time".
Related Links
Revision History
| Revision | Publish Date | Comments |
|---|---|---|
1.0 |
29-Sep-2026
|
Initial Release |
Feedback