Splunk® IT Service Intelligence

Release Notes

Acrobat logo Download manual as PDF


Splunk IT Service Intelligence version 4.1.x reached its End of Life on January 19, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see Before you upgrade IT Service Intelligence.
This documentation does not apply to the most recent version of ITSI. Click here for the latest version.
Acrobat logo Download topic as PDF

Removed features in Splunk IT Service Intelligence

This page lists computing platforms, browsers, and features for which IT Service Intelligence has deprecated or removed support.

Advance notice: Entity Alias Filtering field

The Entity Alias Filtering field used in KPIs and KPI base searches will be removed in the next major ITSI release to improve how entity matching is performed.

What do I need to do to prepare for this change?

When creating a KPI or KPI base search, if the service has entities, you can enable Filter to Entities in Service to filter the entities against which the KPI search runs. Currently the Entity Filter Field and the optional Entity Alias Filtering field are used in combination to determine which entity alias values to use for filtering. After Entity Alias Filtering is removed, only the Entity Filter Field will be used to determine the entity alias values to use for filtering. See Entity filtering in the ITSI Installation and Configuration manual for more information about entity filtering.

To prepare for the future removal of the Entity Alias Filtering field, check the KPIs in your service definitions and your KPI base search definitions to see how the field is used:

  • If the Entity Filter Field and the Entity Alias Filtering field have the same value, no action is necessary.
  • If the fields are different, you need to explicitly add the alias values for the fields specified in the Entity Alias Filtering field to the alias for the field specified in the Entity Filter Field in the entity definition.
  • If the Entity Alias Filtering field is blank, action might be required. Evaluate whether filtering needs to be done on a field other than the one specified in the Entity Filter Field:
    • If the Entity Filter Field is the only alias field you want to use, no action is necessary.
    • If you want to use other fields, go to the entity definition and add all of the entity alias values to the entity alias field specified in the Entity Filter Field

Example filtering clause for blank Entity Alias Filtering field

Consider the following example where the Entity Alias Filtering field is blank.

Entity A has the following aliases:

EntityA.png

Entity B has the following aliases:

EntityB.png

Service A:

Contains both Entity A and Entity B

KPI 1:

KPIfields1.png

Currently (in ITSI 4.1.0 and earlier) the filtering clause in the generated search for KPI 1 uses all the entity alias values:

host=appserver-01 OR host=10.10.10.1 OR host=appserver-02 OR host=web_server02

After the Entity Alias Filtering field is removed, the filtering clause in the generated KPI search for KPI 1 will look like this:

host=appserver-01 OR host=appserver-02

If you want to continue to include the ip_address and component values in the filtering clause, you must add these values to the entity's host alias as shown here:

New aliases for Entity A:

host = appserver-01, 10.10.10.1
ip_address = 10.10.10.1

New aliases for Entity B:

host = appserver-02, web_server02
component = web_server02

Add new alias values for Entity Alias Filtering fields to an entity

If the Entity Alias Filtering field is different from the Entity Filter Field, do the following to ensure the current entity filtering is preserved in future versions of ITSI after the Entity Alias Filtering field is removed:

  1. Click Configure > Entities from the ITSI top menu bar.
  2. Perform the following steps for each entity that is matched by the service's entity rules:
    1. Click Edit.
    2. Add the alias values that correspond to each field set as an Entity Alias Filtering field to the alias of the field specified in the Entity Filter Field.

For example, if a KPI has the following fields set:

KPIfields2.png

And the entity has the following aliases:

EAFNewValues.png

Add the entity alias values for ip_address and component to the host alias:

host = appserver-01, 10.10.10.1, web_server01

After you add the Entity Alias Filtering values, you can set the Entity Alias Filtering field in the KPI to the same field as the Entity Filter Field. This step is optional.

Last modified on 08 April, 2019
PREVIOUS
Known issues in Splunk IT Service Intelligence
  NEXT
Credits

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.1.0


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters