About Entity Overview in ITE Work

The (ITE Work) Entity Overview page provides a holistic view of all entities in your environment.

An entity is an IT infrastructure component that requires management to deliver an IT service. Each entity has specific attributes and relationships to other IT processes that identify the entity. Entities are usually hosts but can also be items as diverse as cloud or virtual resources, network devices, applications, users, and cell towers. For more information about entities, see What is an entity integration?

Use the Entity Overview page to monitor the health of your overall system and quickly understand the availability and performance of your server infrastructure.

You can filter entities by status (Active, Inactive, N/A, or Unstable) using the Status Filter and alert severity (Normal, Warning, Critical) using the Severity Filter. Filter by additional dimensions such as entity alias, entity status, or informational fields in the entities with dimensions field.

Entities are grouped by entity type by default which gives you a consolidated view of the health of each of your integrated platforms. Select Group by: None in the dropdown to ungroup entities.

Use the Hide entity types with no entities setting to hide entity types that don't have entities.

This image shows the Infrastructure Overview grouped by entity type with entity types with no entities hidden.

Supported data sources

A gray histogram or inactive status means you're not collecting data from that particular data source. You need to bring that data into ITE Work using the defined data configuration method so that corresponding entities can be associated with the proper entity type. The following table lists the entity integrations available out-of-the-box in ITE Work and how to configure them:

Data sources	Configuration instructions
*nix Splunk Add-on for Unix and Linux	About the Unix and Linux entity integration in ITE Work
VMware VM VMware Cluster VMware ESXi Host VMware vCenter VMware Datastore	About the VMware vSphere entity integration in ITE Work
Windows	About the Windows entity integration in ITE Work

Investigate vital metrics for an entity type

Select an entity type within Entity Overview to drill further down to its entity details page, which displays vital metrics for that entity type. Vital metrics are statistical calculations based on SPL searches that represent the overall health of entities of that type. Vital metrics can search against both metrics and logs data, while the search result has to be a metric.

In this example, the entity type's vital metrics are average CPU usage, memory usage, disk availability, and network usage:

The vital metrics for all entity types are defined in itsi_entity_type.conf. One vital metric contains "is_key": 1 which designates it as the key statistic displayed in the Infrastructure Overview histogram. Each vital metric in the configuration file contains a list of split_by_fields that attribute the aggregation to each entity associated with the entity type based on the matching_entity_fields. Split by fields enables ITE Work to calculate the distribution of values to display in the histogram.

The vital metrics search of each of the default entity types uses a macro like itsi_entity_type_nix_metrics_indexes to find data. If the entity type histogram or vital metrics shows no data, it's possible that the data resides in another index. If this is the case, modify the macro to include your index.

Monitor entity status

Select Group by: None in the dropdown to monitor individual entities.

Entities discovered from a recurring import search are assigned a status to indicate whether they are actively sending data, enabling you to monitor the health and performance of your environment. The entity status updates when the recurring bulk import runs on its schedule. For more information about how to set up a recurring import search, see Set up a recurring import of entities in ITE Work.

Note: If you have a large number of entities, the recurring bulk import can take longer to complete. Tune the cron schedule of the recurring import searches to search less frequently in order to ensure your entity status updates on time.

The Last Updated column displays the last recorded time that an entity sent data. The Status column displays one of these statuses:

• Active: Indicates that the entity is active and receiving data from the latest discovery window.
• Inactive: Indicates that the entity stopped sending data and is inactive.
• Unstable: Indicates that the entity is unstable because at least one of its data sources is inactive. The data source may not be sending data consistently, lag and be outside of the search window, or the lookback period may be too short.
• N/A: Indicates that the entity doesn't have a status because it is not linked to a data source. Entities that are not created from recurring bulk import searches (such as entities created from a single import) will display this status.

View a breakdown of the entities in your environment by status on the Current Entity Status Breakdown chart, and view a breakdown by alert severity on the Alert Breakdown chart.

Saved searches contribute to an entity's status. Troubleshoot unstable or inactive entities on the Entity Discovery Searches tab. To learn more, see Understand entity status and search data in ITSI.