SPLUNK ITSI CONTENT PACKS INSTALL
SPLUNK ITSI CONTENT PACKS FULL

SPLUNK ITSI CONTENT PACKS INSTALL

If you're using ITSI v4.9 or later, you can install the Content Pack for ITSI Monitoring and Alerting after installing the Splunk App for Content Packs.

SPLUNK ITSI CONTENT PACKS FULL

For a full list of the contents contained within this content pack, see Release notes for the Content Pack for ITSI Monitoring and Alerting. The content pack also ships with other supporting objects including episode views, automatic lookups, dashboards, and sample services. For more information, see About Universal Alerting or About the correlation searches in the Content Pack for ITSI Monitoring and Alerting.

This correlation search onboards all external alerts that comply with the Universal Alerts Field Normalization Standard. For more information about these correlation searches, see About the correlation searches in the Content Pack for ITSI Monitoring and Alerting. The episode monitoring correlation searches routinely inspect open episodes and produce alerts based on a variety of noteworthy circumstances related to those episodes. For more information about these aggregation policies, see About the aggregation policies in the Content Pack for ITSI Monitoring and Alerting. For example, some action rules produce emails, create service tickets, or integrate with Splunk On-Call (formerly VictorOps) or other incident response platforms. The policies also contain action rules that you can tune to meet your organization's alerting strategy.

The aggregation policies provide configuration for grouping related notable events together in useful ways. The service monitoring correlation searches routinely check service and KPI results written to the itsi_summary index and produce notable events based on a variety of noteworthy circumstances related to service and KPI health. This content pack contains the following object types: Rules for when to take action are built on the notable event aggregation policies, and special 'episode monitoring' correlation searches are responsible for detecting alertable conditions and invoking actions on the aggregation policies. Logically related notable events are grouped together by pre-built aggregation policies into episodes. Each of the three main components of the content pack supports an aspect of configuration identified by a gray box in the workflow between finding something worth monitoring and generating alerts on that when system conditions warrant such notification. The diagram shows content pack components in orange, below the outline of the alert configuration process. The grey boxes represent configurations that the ITSI administrator or service owner must perform before ITSI can produce actionable alerts. To better understand what's included in this content pack, consider the standard workflow for configuring ITSI to take action on service and KPI health with the following diagram. Refresher: How alerts are generated in ITSI See Create a full backup of ITSI in the Administration Manual. If you do restore the content to an active environment, you must back up your environment first. Use this content pack as a starting point in a clean ITSI environment. Universal Alerting, for external alerts.Service Monitoring, for ITSI services and KPIs.This content pack includes three feature areas: The content pack also provides a faster method for onboarding external alerts into ITSI with universal alerting. The content pack provides a set of preconfigured correlation searches and notable event aggregation policies which, when enabled, produce meaningful and actionable alerts. It helps ITSI administrators and service owners quickly translate service and KPI health into notable events and take action when necessary. The Content Pack for ITSI Monitoring and Alerting provides a prescriptive blueprint for enterprise-wide alerting across all your services. About the Content Pack for ITSI Monitoring and Alerting

Splunk itsi content packs