Splunk® IT Service Intelligence

Administration Manual

Acrobat logo Download manual as PDF

Splunk IT Service Intelligence version 4.0.x reached its End of Life on January 19, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see Plan an upgrade of IT Service Intelligence.
This documentation does not apply to the most recent version of Splunk® IT Service Intelligence. Click here for the latest version.
Acrobat logo Download topic as PDF

Update a service template in ITSI

Make updates to a service template to update all the services linked to the template. You can choose to push updates to the linked services immediately or schedule a specific date and time to push the updates.

  1. Click Configure > Service Templates.
  2. Open a service template.
  3. On the Entities tab, add, modify, or delete entity rules as desired.
    Use the matches a value to be defined in the service or does not match a value to be defined in the service options to specify the value for an entity rule in each service rather than in the template. This is useful if each service linked to the template will be monitoring different entities. For example, you could specify Alias vm_name matches a value defined in the service. Then, after the services have been synced with the template, specify the value for vm_name in each service. These options are particularly useful if you plan to bulk import services and link them to the template.

    If you use the configurable entity rules described above and choose to Overwrite Entity Rules when you save the service template, any entity rules already defined in the linked services will be replaced with the entity rules from the template and they will have blank values (matching all entities).

  4. On the KPI tab, add, modify, or delete the KPIs in the template, and set KPI thresholds as desired. Any KPIs you add to the template must use a base search. Template KPIs cannot use ad hoc, metrics, or data model searches.

    You cannot enable anomaly detection in a service template. You must enable anomaly detection for a KPI in the service directly.

  5. On the Settings tab, set importance values for the KPIs and see how they affect the health score of linked services.
  6. When you finish making modifications to the service template, click Save.
  7. In the Save Service Template dialog box, indicate what information to update and select when to push the changes to the linked services.
    Setting Description
    Overwrite Entity Rules Replaces the entity rules in the linked services with the entity rules in the template.
    Overwrite KPI Thresholds on Choose whether you want to update KPI thresholds. If you have customized some of the KPI thresholds in your services and you want to keep these thresholds, select All Unchanged KPIs. To overwrite customized KPI thresholds in linked services, select All KPIs. This setting does not affect KPI thresholds for any KPIs that are unique to the service and not linked to the template.
    Overwrite Health Score Replaces the KPI importance values that are used to calculate the health score in the linked services with the KPI importance values from the template. KPI importance values for any additional KPIs in the service that are not present in the template are not affected. KPI importance values for dependent services are also not affected.
    Push changes to services Choose to push the changes immediately, or select Later to choose a date and time to update the linked services. It is usually recommended to push changes to services outside of regular business hours to avoid disruption.
  8. Click Save. The changes in the template are immediately propagated to the linked services if you chose to push the changes now or at the date and time you selected.
  9. Click the Linked Services tab to see the sync status of the services linked to the template.

After the linked services are synced with the template, the status says Synced. If you elected to push the changes now, you might need to refresh your browser to see the status change. You will also receive a message in Splunk Web with the status of the sync.

You can only schedule one sync for a service template. If you make additional updates to a service template that is already scheduled, you can keep the scheduled time (the default) or choose to sync now or at a different time. All updates that have been made to the template are pushed at the time you choose.

Last modified on 04 February, 2019
Create a service template in ITSI
Link a service to a service template in ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters