Migrate from the Content Pack for Splunk Synthetic Monitoring to the Content Pack for Splunk Observability Cloud

The Content Pack for Splunk Synthetic Monitoring was replaced by the Content Pack for Splunk Observability Cloud in version 1.4.0 of the Splunk App for Content Packs. If you were using the Content Pack for Splunk Synthetic Monitoring follow these steps to migrate to the Content Pack for Splunk Observability Cloud.

Prerequisite

Create a full backup of your ITSI environment. For more information, see Create a full backup in the Administration Manual.

Step 1: Disable the content pack app

1. Go to Apps > Manage Apps
2. Search for "Splunk Synthetics".
3. Locate Folder Name: DA-ITSI-CP-splunk-synthetics and select Disable under Status.

Step 2: Remove Splunk Synthetic Monitoring entity search

1. Go to Settings > Searches, reports, and alerts.
2. Filter by App: IT Service Intelligence (itsi) and Owner: All.
3. Search for "ITSI Import Objects".
4. Locate your Splunk Synthetic Monitoring entity search: ITSI Import Objects - Get_SSM_Entities.
5. Select Edit > Delete.

Step 3: Remove Content Pack for Splunk Synthetic Monitoring objects

There are two options to remove the content pack objects:

1. Remove through the ITSI user interface.
2. Use REST API calls. This approach is faster.

Option 1: Remove the Content Pack for Splunk Synthetic Monitoring objects through the ITSI user interface

Step 1: Remove the Content Pack for Splunk Synthetic Monitoring entities

1. From the ITSI menu go to Configuration > Entities.
2. Under Advanced Filter create this filter rule: Service Title: "*Synthetic Checks*"
3. Select all entities and select Bulk Action > Delete selected.

The list of entities is paginated. Be sure to delete all entities.

Step 2: Remove the Content Pack for Splunk Synthetic Monitoring entity types

1. From the ITSI menu go to Configuration > Entities.
2. Go to the Entity Type tab.
3. For each of these entity types, select Edit > Delete.
   • Synthetic API
   • Synthetic Benchmark
   • Synthetic Content
   • Synthetic HTTP
   • Synthetic Real Browser

Step 3: Remove the Content Pack for Splunk Synthetic Monitoring services

1. From the ITSI menu go to Configuration > Services.
2. Search for "Synthetic".
3. Select Edit > Delete for each of these services and any others you might have created:
   • All API Synthetic Checks
   • All Benchmark Synthetic Checks
   • All Content Synthetic Checks
   • All HTTP Synthetic Checks
   • All Real Browser Synthetic Checks
   • All Splunk Synthetic Monitoring Checks
   • Splunk Synthetic Monitoring Check Template - (start here)

Step 4: Remove the Content Pack for Splunk Synthetic Monitoring KPI base searches

1. From the ITSI menu go to Configuration > KPI Base Searches.
2. Search for "SSM".
3. Select Edit > Delete for each of these KPI base searches and any others you might have created:
   • SSM_api_checks
   • SSM_benchmark_checks
   • SSM_content_checks
   • SSM_http_checks
   • SSM_real_browser_checks

Option 2: Use REST API calls to remove the Content Pack for Splunk Synthetic Monitoring objects

If you have a lot of entities, deleting objects via the API is faster.

For each REST API call, use GET to verify only the desired objects are returned for the Content Pack for Splunk Synthetic Monitoring. The REST API calls should be made in order. For information on the Splunk ITSI REST API, see the ITSI REST API Reference manual.

1. Verify the Content Pack for Splunk Synthetic Monitoring entities.

   curl -k -u admin:password -X GET 'https://<Splunk server>:8089/servicesNS/nobody/SA-ITOA/itoa_interface/entity/?fields=title,entity_type_ids&filter={"entity_type_ids":{"$regex":"da-itsi-cp-splunk-synthetics.*"}}'

2. Remove the Content Pack for Splunk Synthetic Monitoring entities.

   curl -k -u admin:password -X DELETE 'https://<Splunk server>:8089/servicesNS/nobody/SA-ITOA/itoa_interface/entity/?filter={"entity_type_ids":{"$regex":"da-itsi-cp-splunk-synthetics.*"}}'

3. Verify the Content Pack for Splunk Synthetic Monitoring entity type.

   curl -k -u admin:password -X GET 'https://<Splunk server>:8089/servicesNS/nobody/SA-ITOA/storage/collections/data/itsi_entity_type?query={"source_itsi_da":"DA-ITSI-CP-splunk-synthetics"}'

4. Remove the Content Pack for Splunk Synthetic Monitoring entity type.

   curl -k -u admin:password -X DELETE 'https://<Splunk server>:8089/servicesNS/nobody/SA-ITOA/storage/collections/data/itsi_entity_type?query={"source_itsi_da":"DA-ITSI-CP-splunk-synthetics"}'

5. Verify the Content Pack for Splunk Synthetic Monitoring services, KPIs and KPI base searches.

   curl -k -u admin:password -X GET 'https://<Splunk server>:8089/servicesNS/nobody/SA-ITOA/storage/collections/data/itsi_services?query={"source_itsi_da":"DA-ITSI-CP-splunk-synthetics"}'

6. Remove the Content Pack for Splunk Synthetic Monitoring services, KPIs and KPI base searches.

   curl -k -u admin:password -X DELETE 'https://<Splunk server>:8089/servicesNS/nobody/SA-ITOA/storage/collections/data/itsi_services?query={"source_itsi_da":"DA-ITSI-CP-splunk-synthetics"}'

Step 4: Install the Content Pack for Splunk Observability Cloud

Once you have deleted all the objects from the Content Pack for Splunk Synthetic Monitoring, you can install the Content Pack for Observability Cloud. See the Install and configure the Content Pack for Splunk Observability Cloud topic for installation steps.