Splunk® IT Service Intelligence

Administration Manual

Acrobat logo Download manual as PDF


Splunk IT Service Intelligence version 4.0.x reached its End of Life on January 19, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see Plan an upgrade of IT Service Intelligence.
This documentation does not apply to the most recent version of ITSI. Click here for the latest version.
Acrobat logo Download topic as PDF

Bulk import services in ITSI

ITSI provides two methods to bulk import service definitions:

Import from CSV
Import service definitions from a CSV file.
Import from search
Import service definitions from Splunk searches.

You can use either bulk import method to do the following:

  • Create multiple services.
  • Add service dependencies.
  • Link services to service templates (and provide entity rule values for configurable service template entity rules).
  • Add associated entities to services.

If importing services without linking them to service templates, you can import a few thousand services at a time. Do not attempt to import more than a thousand services with links to service templates. If you need to import more than a thousand services and link them to service templates, do the imports in smaller batches. It is recommended to import a maximum of 200-300 services with links to service templates at a time. In general, if a service template has a small number of KPIs and entity rules, a larger number of services can be imported and linked to it. If a service template contains a very large number of KPIs and entity rules, a smaller number of services can be imported and linked to it.

Use cases

Create new services without linking them to service templates

To do this, create a CSV file or a search that contains the services to import. In the first row of a CSV, specify column names. In each subsequent row, specify one service, and, optionally, a service description and one or more service dependencies. Note that the services created through this method will not be populated with KPIs or entities.

Create new services and link them to service templates or link existing services to service templates

When you link a service to a service template, the service will receive the KPIs and entity rules from the template. Note that if a service already exists, any entity rules in the service will be replaced by the entity rules in the service template. For more information about service templates, see Create and manage service templates in ITSI.

Create a CSV file or a search that contains the services to import and the corresponding template to link them to. In the first row of a CSV, specify column names. In each subsequent row, specify one service, and, optionally, a service description and one or more service dependencies, and the name of the service template to link the service to. Also include one or more columns that provide values for the configurable entity rules in the service templates. Before creating the CSV or search, review the entity rules for the service templates you want to link services to in order to determine which entity rules have configurable values so that you can provide those values for each service in the CSV or search.

Create services with associated entities

Create a CSV file or search that contains the services and entities to import. An entity rule will be created for the service with Entity Title matches <value from Entity Title column> for each entity. See Bulk import entities for an example.

Import services, link them to service templates, and import entities

When you import services and link them to service templates, you must provide one or more columns to use as values for any configurable entity rules in the templates. If you also want to import entities, you may do so, using either a separate column for this purpose or the same column that is used for configurable entity rules. In this case, entities will be created for the column you import as Entity Title but instead of Entity Title matches <value from Entity Title column> entity rules being added to the service (which is the case when not linking a service to a service template), the entity rules from the linked template will be added to the service and any configurable entity rules will use the column(s) you specify as the value for the configurable entity rules.

You can set up a recurring import (via modular input) at the end of the bulk import process.

Only users assigned the itoa_admin role can perform a bulk import of services.

Import from CSV

You can create new services by importing the contents of a CSV file. The rows and columns that your CSV file should contain depends on the use case. This section contains an example of importing services and linking them to service templates.

Import from CSV has a limit of one service and one entity per row. There is no limit on the number of dependent services, entity aliases, entity information fields, or entity rule values per row. You can use multiple columns for service dependencies or multiple rows containing the same service and each of its service dependencies. Likewise you you can have multiple rows containing the same service and each entity to add to it. A CSV file can contain multiple rows. Import from CSV supports five different separators: comma (,), semicolon (;), pipe (|), tab (\t), and caret (^).

Prerequisite

If you are linking services to service templates, create the service templates first. Service templates cannot be created through the bulk import process; the service templates you want to link services to must already exist in ITSI. See Create and manage service templates in ITSI for information on how to create a service template.

Steps

  1. Create a CSV file that contains your services.
    In this example, we want to create five services and link them to two different service templates. App Service 1 depends on Web A. App Service 2 depends on Web B. Three columns (applicationname, app_title, and host) provide entity rule values for the services.
    Template.png
  2. After you create your CSV file, click Configure > Services.
  3. Click New Service > Import from CSV.
  4. Click browse... and select your CSV file, or drop it into the UI.
    The CSV file is uploaded and a file preview displays.
  5. Click Next to see a table populated by the content of your CSV file.
  6. In the Import Column As column, choose how to categorize each column in your file.
    Column type Description
    Service Title Makes the column entry the name of the service.
    Service Description Makes the column entry a description of the service.
    Dependent Services Makes the column entry a dependent service.
    Service Template Link Makes the column entry the service template to link the service to. Note that the service template must already exist in ITSI.
    Do Not Import Removes the column entry from the imported data. Use this for columns containing entity rule values if you are linking services to service templates. You will specify the column to use for entity rules later in the workflow.

    For our example, we are importing the columns in the CSV file as follows. Note that applicationname, app_title, and host are not being imported. This is because these columns contain entity rule values that are different for each service. They will be used in the Define Entity Rules step later.
    TemplateColumns.png

  7. In the Settings section, configure the following fields:
    Field Description
    Service Team Select the team to create the services in.
    Import Services As Choose if you want services enabled or disabled upon import. KPI searches will not run if the service is disabled.
    Enable 7 days of backfill for all service KPIs This setting appears if you have selected to import columns as Service Title and Service Template Link. This backfills the KPIs in imported services that are linked to service templates. Enable this setting if you do not have at least seven day's worth of data in the ITSI summary index and you want to be able to use anomaly detection or adaptive thresholding for any of the KPIs in the service template. Note that backfill cannot be enabled for individual KPIs in service templates or services.
  8. Use the Preview section to confirm that your service import configuration is correct.
  9. Click Next.
  10. Perform one of the following tasks:
    • If you selected to import a column as a Service Template Link, go to the Define Entity Rules step (Step 11).
    • If you are not linking services to service templates, skip to the Import step (Step 14).
  11. In the Define Entity Rules step, select a service template to complete the template entity rules.

    For the templates that have configurable entity rules, the Entity Rules Complete column displays "Incomplete".

    In this example, the Web Store template has four entity rules. One of them has a value defined in the template: itsi_role matches operating_system_host. Every service linked to this template will receive this field value pair. The other three entity rules have values in the service template of matches a value to be defined in the service. Therefore the value must be provided for each service in this step using a column from the CSV file.

  12. Click Select a column to provide the entity rule value for each configurable entity rule in the template as shown in the example below.
    Entityrules web store template.png
    In our example, the Web A service will receive *Web* for the applicationname value, New_Relic_Buttercup_Web:8675309 for the app_title value and webserver* for the host value.
  13. Preview the entities for each service linked to the template. Note that only existing entities in ITSI can be matched. Any entities being imported will not be displayed in the preview.
  14. Click Import. A message confirms that the import is complete.
  15. Click View All Services to confirm your imported services now appear on the Service viewer page. If you linked services to templates, the Service Template column indicates that it's synced with the service template. The KPIs and entity rules for the services are populated from the template and any configurable entity rules that came from the template contain the value from the column you specified in the import.
  16. (Optional) Click Set up Recurring Import to create a modular input for the CSV file. See Set up recurring import in this manual.

Import from search

You can import multiple services from ITSI module searches, saved searches, and ad hoc searches. The Import from Search workflow is identical to the import from CSV workflow, except that you specify a search string instead of uploading a CSV file.

The example in this section shows you how to import services and entities and associate the entities with the services. For an example of importing services and linking them to service templates, see the Import from CSV section.

Prerequisite

If you are linking services to service templates, create the service templates first. Service templates cannot be created through the bulk import process. The service templates must already exist in ITSI. See Create and manage service templates in ITSI for information on how to create a service template.

Steps

  1. Select New Service > Import from search.
  2. Select one of the following search types:
    Search Type Description
    Modules Choose from a list of pre-defined entity discovery searches based on ITSI modules.
    Saved Search Choose from a list of pre-defined ITSI saved searches.
    Ad hoc Search Enter a custom search string.
  3. Enter an ad hoc search string or select a predefined module search or saved search. Make sure the results are presented in a table.
    For this example we are using an ad hoc search to import services and entities.
  4. Click the Search icon.
    The specified search runs and a Search Results Preview appears.
    We want to create two services called Splunk Search Head Service and Splunk Indexer Service (using the service_title column) and create three entities for the hosts listed in the host column and add these entities to the services. EntityImportSearch.png
  5. Click Next.
    The Select Columns page appears, showing a table populated by your search results. Use this page to specify how to classify and store the file column entries that define your entities.
  6. For our example, we are importing the columns in our search results as follows. ImportSpecifyColumns.png
  7. In the Settings section, configure the following items:
    Field Description
    Service Team Select the team to create the services in. Entities are always created in the Global team.
    Import Services As Choose if you want services enabled or disabled upon import.
    Conflict Resolution Select an option to determine how ITSI will update and store your entity data.
    • Skip Over Existing Entities: Adds all new entity data to the datastore.
    • Update Existing Entities: Combines two records into a single record.
    • Replace Existing Entities: Replaces existing entity data with new entity data.

    For more information on Conflict Resolution see Conflict Resolution examples below.

  8. In the Preview section, click Services to be imported to confirm that your service import configuration is correct. Also check the entities to be imported if you are also importing entities.
    BulkImportPreview.png
  9. Click Import.
    A message appears confirming that the import is complete.
  10. Click View All Services or View all Entities to confirm that your imported services and entities now appear on the respective Service or Entity lister page.
  11. (Optional) Click Set up Recurring Import to create a modular input that runs the import from search job on a recurring basis. See Set up recurring import.
Last modified on 30 July, 2019
PREVIOUS
Clone a service in ITSI
  NEXT
How service health scores work in ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters