Removed features in Splunk IT Service Intelligence
This page lists computing platforms, browsers, and features for which IT Service Intelligence has deprecated or removed support.
Advance notice: Entity Alias Filtering field
The Entity Alias Filtering field used in KPIs and KPI base searches will be removed in the next major ITSI release to improve how entity matching is performed.
What do I need to do to prepare for this change?
When creating a KPI or KPI base search, if the service has entities, you can enable Filter to Entities in Service to filter the entities against which the KPI search runs. Currently the Entity Filter Field and the optional Entity Alias Filtering field are used in combination to determine which entity alias values to use for filtering. After Entity Alias Filtering is removed, only the Entity Filter Field will be used to determine the entity alias values to use for filtering. See Entity filtering in the ITSI Installation and Configuration manual for more information about entity filtering.
To prepare for the future removal of the Entity Alias Filtering field, check the KPIs in your service definitions and your KPI base search definitions to see how the field is used:
- If the
Entity Filter Fieldand the
Entity Alias Filteringfield have the same value, no action is necessary.
- If the fields are different, you need to explicitly add the alias values for the fields specified in the
Entity Alias Filteringfield to the alias for the field specified in the
Entity Filter Fieldin the entity definition.
- If the
Entity Alias Filteringfield is blank, action might be required. Evaluate whether filtering needs to be done on a field other than the one specified in the
Entity Filter Field:
- If the
Entity Filter Fieldis the only alias field you want to use, no action is necessary.
- If you want to use other fields, go to the entity definition and add all of the entity alias values to the entity alias field specified in the
Entity Filter Field
- If the
Example filtering clause for blank Entity Alias Filtering field
Consider the following example where the Entity Alias Filtering field is blank.
Entity A has the following aliases:
Entity B has the following aliases:
Contains both Entity A and Entity B
Currently (in ITSI 4.1.0 and earlier) the filtering clause in the generated search for KPI 1 uses all the entity alias values:
host=appserver-01 OR host=10.10.10.1 OR host=appserver-02 OR host=web_server02
After the Entity Alias Filtering field is removed, the filtering clause in the generated KPI search for KPI 1 will look like this:
host=appserver-01 OR host=appserver-02
If you want to continue to include the
component values in the filtering clause, you must add these values to the entity's
host alias as shown here:
New aliases for Entity A:
host = appserver-01, 10.10.10.1
ip_address = 10.10.10.1
New aliases for Entity B:
host = appserver-02, web_server02
component = web_server02
Add new alias values for Entity Alias Filtering fields to an entity
If the Entity Alias Filtering field is different from the Entity Filter Field, do the following to ensure the current entity filtering is preserved in future versions of ITSI after the Entity Alias Filtering field is removed:
- Click Configure > Entities from the ITSI top menu bar.
- Perform the following steps for each entity that is matched by the service's entity rules:
- Click Edit.
- Add the alias values that correspond to each field set as an Entity Alias Filtering field to the alias of the field specified in the Entity Filter Field.
For example, if a KPI has the following fields set:
And the entity has the following aliases:
Add the entity alias values for
component to the
After you add the Entity Alias Filtering values, you can set the Entity Alias Filtering field in the KPI to the same field as the Entity Filter Field. This step is optional.
Known issues in Splunk IT Service Intelligence
This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.1.0