Splunk® IT Essentials Work

Entity Integrations Manual

This documentation does not apply to the most recent version of Splunk® IT Essentials Work. For documentation on the most recent version, go to the latest release.

Resolve conflicts during ITE Work entity imports

When you import entities from CSV or search, you have to select a conflict resolution type and a conflict resolution field. The conflict resolution field is the field you want to use to identify entities. Entities that have the same value for the conflict resolution field are considered to be the same entity. The conflict resolution type determines how ITE Work updates and stores your entity data. The following examples demonstrate the behavior of each conflict resolution type.

Skip Over Existing Entities

The Skip Over Existing Entities conflict resolution type adds new entity data to the datastore only if the entity does not already exist. If an entity exists, the information is not updated.

For example, if you import the following CSV file and you use title as the Conflict Resolution field, if Server_1 and Server_2 already exist as entities, they are not updated with the imported data. If no entities already exist with a title of Server_1 or Server_2, these entities are created from the imported data.

title, IP, host
Server_1, 192.168.1.1, somehostName
Server_2, 192.168.2.2, anotherhostName

Update Existing Entities

The Update Existing Entities conflict resolution type merges the Alias and Info fields of imported entities with existing entities. Entities that have the same value in the Conflict Resolution field are treated as the same entity:

  • Each entity that matches the Conflict Resolution field value receives the merged field values.
  • If the Conflict Resolution field doesn't exist in the existing entity, the existing entity isn't affected.
  • If the Conflict Resolution field doesn't exist in the CSV or search data, the row data isn't imported.
  • If the Conflict Resolution field is an Alias field, but in the existing entity the field is an Info field, the existing Info field is preserved.
  • If the Conflict Resolution field is an Info field, but in the existing entity the field is an Alias field, the existing Alias field is preserved.

In this example, the entities in the first example are created and now you import the following updated entity information using title as the Conflict Resolution field:

title, IP, host
Server_1, 192.168.1.1, somehostName
Server_2, 192.168.2.3, anotherhostName

Server_2 will now have two IP addresses, 192.168.2.2 and 192.168.2.3, while no new data is added to Server_1.

Replace Existing Entities

The Replace Existing Entities conflict resolution field replaces existing entity data with new entity data. Entities that have the same value in the Conflict Resolution field are treated as the same entity. For example, you can import this entity information using title as the Conflict Resolution field using the following syntax:

title, IP, host
Server_1, 192.168.1.2, somehostName2
Server_2, 192.168.2.2, anotherhostName2

The Server_1 and Server_2entities, which already exist, are replaced with the new entity definitions for Server_1 and Server_2in the import. The old Alias and Info fields for the entities are replaced with the ones in the import, so Server_1 now has an IP of 192.168.1.2 and a host of somehostName2 and Server_2 now has an IP of 192.168.2.2 and a host of anotherhostName2.

Example of using a Conflict Resolution field other than Entity Title with Update Existing Entities option

For example, say you have two hosts with the same name in different data centers. You import the following columns:

Entity Title (Name) Information Field
host=A datacenter=A
host=A datacenter=B

If you use the host column (Entity Title) as the Conflict Resolution field, and use the Update Existing Entities option, one entity is created because both entities have the same value for host.This means they are treated as the same entity. After importing, entity A contains both A and B values for datacenter as shown in this table:

Entity Title (Name) Alias Information Field
A host=A datacenter=A,B

If instead you use the datacenter column (Entity Information Field) as the Conflict Resolution field with the Update Existing Entities option, two entities will be created: the first entity A will be created with an Information field of datacenter=A and a second entity A will be created with datacenter=B as shown below.

Entity Title (Name) Alias Information Field
A host=A datacenter=A
A host=A datacenter=B
Last modified on 28 April, 2023
Set up a recurring import of entities in ITE Work   Manually delete entities you don't want to analyze in ITE Work

This documentation applies to the following versions of Splunk® IT Essentials Work: 4.9.0, 4.9.1, 4.9.2, 4.9.3, 4.9.4, 4.9.5, 4.9.6, 4.10.0 Cloud only, 4.10.1 Cloud only, 4.10.2 Cloud only, 4.10.3 Cloud only, 4.10.4 Cloud only, 4.11.0, 4.11.1, 4.11.2, 4.11.3, 4.11.4, 4.11.6, 4.12.0 Cloud only, 4.12.2 Cloud only, 4.13.0, 4.13.1, 4.13.2, 4.13.3, 4.14.0 Cloud only, 4.14.1 Cloud only, 4.14.2 Cloud only, 4.15.0, 4.15.1, 4.15.2, 4.15.3


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters