Resolve conflicts during ITE Work entity imports
When you import entities from CSV or search, you have to select a conflict resolution type and a conflict resolution field. The conflict resolution field is the field you want to use to identify entities. Entities that have the same value for the conflict resolution field are considered to be the same entity. The conflict resolution type determines how ITE Work updates and stores your entity data. The following examples demonstrate the behavior of each conflict resolution type.
Skip Over Existing Entities
The Skip Over Existing Entities conflict resolution type adds new entity data to the datastore only if the entity does not already exist. If an entity exists, the information is not updated.
For example, if you import the following CSV file and you use title
as the Conflict Resolution field, if Server_1
and Server_2
already exist as entities, they are not updated with the imported data. If no entities already exist with a title of Server_1
or Server_2
, these entities are created from the imported data.
title, IP, host Server_1, 192.168.1.1, somehostName Server_2, 192.168.2.2, anotherhostName
Update Existing Entities
The Update Existing Entities conflict resolution type merges the Alias and Info fields of imported entities with existing entities. Entities that have the same value in the Conflict Resolution field are treated as the same entity:
- Each entity that matches the Conflict Resolution field value receives the merged field values.
- If the Conflict Resolution field doesn't exist in the existing entity, the existing entity isn't affected.
- If the Conflict Resolution field doesn't exist in the CSV or search data, the row data isn't imported.
- If the Conflict Resolution field is an Alias field, but in the existing entity the field is an Info field, the existing Info field is preserved.
- If the Conflict Resolution field is an Info field, but in the existing entity the field is an Alias field, the existing Alias field is preserved.
In this example, the entities in the first example are created and now you import the following updated entity information using title
as the Conflict Resolution field:
title, IP, host Server_1, 192.168.1.1, somehostName Server_2, 192.168.2.3, anotherhostName
Server_2
will now have two IP addresses, 192.168.2.2
and 192.168.2.3
, while no new data is added to Server_1
.
Replace Existing Entities
The Replace Existing Entities conflict resolution field replaces existing entity data with new entity data. Entities that have the same value in the Conflict Resolution field are treated as the same entity. For example, you can import this entity information using title
as the Conflict Resolution field using the following syntax:
title, IP, host Server_1, 192.168.1.2, somehostName2 Server_2, 192.168.2.2, anotherhostName2
The Server_1
and Server_2
entities, which already exist, are replaced with the new entity definitions for Server_1
and Server_2
in the import. The old Alias and Info fields for the entities are replaced with the ones in the import, so Server_1
now has an IP of 192.168.1.2
and a host of somehostName2
and Server_2
now has an IP of 192.168.2.2
and a host of anotherhostName2
.
Example of using a Conflict Resolution field other than Entity Title with Update Existing Entities option
For example, say you have two hosts with the same name in different data centers. You import the following columns:
Entity Title (Name) | Information Field |
---|---|
host=A | datacenter=A |
host=A | datacenter=B |
If you use the host
column (Entity Title) as the Conflict Resolution field, and use the Update Existing Entities option, one entity is created because both entities have the same value for host.This means they are treated as the same entity. After importing, entity A contains both A and B values for datacenter
as shown in this table:
Entity Title (Name) | Alias | Information Field |
---|---|---|
A | host=A | datacenter=A,B |
If instead you use the datacenter
column (Entity Information Field) as the Conflict Resolution field with the Update Existing Entities option, two entities will be created: the first entity A will be created with an Information field of datacenter=A
and a second entity A will be created with datacenter=B
as shown below.
Entity Title (Name) | Alias | Information Field |
---|---|---|
A | host=A | datacenter=A |
A | host=A | datacenter=B |
Set up a recurring import of entities in ITE Work | Manually delete entities you don't want to analyze in ITE Work |
This documentation applies to the following versions of Splunk® IT Essentials Work: 4.9.0, 4.9.1, 4.9.2, 4.9.3, 4.9.4, 4.9.5, 4.9.6, 4.10.0 Cloud only, 4.10.1 Cloud only, 4.10.2 Cloud only, 4.10.3 Cloud only, 4.10.4 Cloud only, 4.11.0, 4.11.1, 4.11.2, 4.11.3, 4.11.4, 4.11.6, 4.12.0 Cloud only, 4.12.2 Cloud only, 4.13.0, 4.13.1, 4.13.2, 4.13.3, 4.14.0 Cloud only, 4.14.1 Cloud only, 4.14.2 Cloud only, 4.15.0, 4.15.1, 4.15.2, 4.15.3
Feedback submitted, thanks!