
List of ITSI configuration files
The following is a list of ITSI configuration files. All files are located under $SPLUNK_HOME/etc/apps/
. Most .conf files have accompanying spec and example files located in the README folder that list all supporting attributes. Contact Support before editing a conf file that does not have an accompanying spec or example file.
If you are using Splunk Cloud, you can't edit a .conf file directly. For any task that requires editing a .conf file, submit a ticket using the Support Portal and Splunk Support will work with you to arrange a maintenance window.
Caution: Never change or copy the configuration files in the default directory. Default files must remain intact and in their original location. The upgrade process overwrites the default directory, so any changes that you make in the default directory are lost on upgrade. Create and edit your files in a local directory, for example $SPLUNK_HOME/etc/apps/<app_name>/local
. Local directories are not overwritten during upgrades. For more information, see Configuration file directories.
If the same configuration file exists in both /itsi/default
and /SA-ITOA/default
, use the file in the /SA-ITOA/default
directory to make your configuration file updates.
File | Purpose | ITSI Location |
---|---|---|
alert_actions.conf | Register custom actions for event management. | /SA-ITOA/default |
app_common_flags.conf | Enable/disable custom drilldown for basic figures, convert basic figures to search widgets, and enable search dispatcher to run searches. | /itsi/default |
app.conf | Configure app properties. | /itsi/default |
authorize.conf | Configure ITSI specific roles and capabilities, including role-based access controls. Always use /itsi/default . For more information, see Enable/disable ITSI capabilities for a role. |
/itsi/default |
collections.conf | Configure KV Store collections for ITSI. | /SA-ITOA/default |
commands.conf | Connect search commands to any custom search script. | /SA-ITOA/default |
datamodels.conf | Attribute/value pairs for configuring data models. | /DA-ITSI-APPSERVER/default /DA-ITSI-LB/default /DA-ITSI-VIRTUALIZATION/default |
deep_dive_drilldowns.conf | Configure deep dive drilldowns, add new drilldowns. | /itsi/default |
distsearch.conf | Specify behavior for distributed search. Group search peers to facilitate searching on a subset of peers. | /SA-ITOA/default |
drilldownsearch_offset.conf | Configure time range picker presets. | /itsi/default |
fields.conf | Create multivalue fields and add search capability for indexed fields. | /itsi/default |
glasstable_icon_library.conf | Add and remove icons from the glass table icon library. | /itsi/default |
inputs.conf | Set up data inputs. | /SA-ITOA/default |
itsi_da.conf | (Deprecated) Configure an app to export entity searches and service templates for use within ITSI. | /SA-ITOA/default |
itsi_deep_dive.conf | Upload sample deep dives to the KV store. | /SA-ITOA/default |
itsi_glass_table.conf | Upload sample glass tables to the KV store. | /SA-ITOA/default |
itsi_kpi_base_search.conf | Upload sample KPI base searches to the KV store. | /SA-ITOA/default |
itsi_kpi_template.conf | Upload sample KPI templates to the KV store. | /SA-ITOA/default |
itsi_kpi_threshold_template.conf | Upload sample KPI threshold templates to the KV store. | /SA-ITOA/default |
itsi_module_settings.conf | Define whether a module is editable in the module lister page. Default is false. | /DA-ITSI-EUEM/default DA-ITSI-WEBSERVER/default |
itsi_module_viz.conf | Change tab names and panel titles in a module details dashboard. | /DA-ITSI-EUEM/default DA-ITSI-WEBSERVER/default |
itsi_notable_event_retention.conf | Define how long notable events are retained before they move to the index. Default is 6 months. | /SA-ITOA/default |
itsi_notable_event_severity.conf | Configure the colors associated with different severity levels in Episode Review. | /SA-ITOA/default |
itsi_notable_event_status.conf | Configure lable descriptions and event status in Episode Review. | /SA-ITOA/default |
itsi_service.conf | Upload sample services to the KV store. | /SA-ITOA/default |
itsi_service_analyzer.conf | Configure auto-refresh interval, or disable auto-refresh. | /SA-ITOA/default |
itsi_service_template.conf | Configure an app to export service templates for use within ITSI. | /SA-ITOA/default |
itsi_settings.conf | Configure ITSI. | /SA-ITOA/default |
itsi_team.conf | Upload sample ITSI teams to the KV store. | /SA-ITOA/default |
limits.conf | Set various limits (such as maximum result size or concurrent real-time searches) for search commands. | /SA-ITOA/default |
macros.conf | Define search macros in Settings. | /SA-ITOA/default |
mad.conf | Configure anomaly detection. | /SA-ITSI-MetricAD/default |
notable_event_commonality.conf | Define fields to include or exclude from the Common Fields tab of Episode Review. | /SA-ITOA/default |
notable_event_correlation.conf | Set threshold values and limits for Smart Mode event correlation. | /SA-ITOA/default |
notable_event_actions.conf|notable_event_actions.conf | Configure actions to take on groups in Episode Review. | /SA-ITOA/default |
props.conf | Set indexing property configurations, including timezone offset, custom source type rules, and pattern collision priorities. Also, map transforms to event properties. | /SA-ITOA/default |
restmap.conf | Create custom REST endpoints. | /SA-ITOA/default |
savedsearches.conf | Define ordinary reports, scheduled reports, and alerts. | /SA-ITOA/default |
searchbnf.conf | Configure the search assistant. | /SA-ITOA/default |
threshold_labels.conf | Configure settings for severity-level thresholds. Change the label, color, threshold level, health weight, minimum and maximum health score, and score contribution. | /itsi/default |
threshold_periods.conf | Deprecated. Do not edit. | /itsi/default |
transforms.conf | Configure regex transformations to perform on data inputs. Use in tandem with props.conf. | /SA-ITOA/default |
ui-tour.conf | Customize the ITSI product tour. | /itsi/default |
visualizations.conf | Declare common visualizations that other modules can use. | /SA-ITSI-CustomModuleViz/default |
web.conf | Configure Splunk Web, enable HTTPS. | /SA-ITOA/default |
PREVIOUS About configuration files in ITSI |
NEXT Troubleshoot ITSI permissions, teams, backups, and restores |
This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4
Feedback submitted, thanks!