Update a service template in ITSI
Make updates to a service template to update all the services linked to the template. You can choose to push updates to the linked services immediately or schedule a specific date and time to push the updates.
To update a service template, you must have the
write_itsi_base_service_templatecapability and have write access to the Global team. Users with the
itoa_adminrole have this capability by default.
Users with team admin roles (roles that inherit from the itoa_team_admin role) have a read-only view of the Service Templates lister page. Team admins cannot create or change service templates but they can create services for their teams using service templates.
- Click Configure > Service Templates.
- Open a service template.
- On the Entities tab, add, modify, or delete entity rules as desired.
Use the matches a value to be defined in the service or does not match a value to be defined in the service options to specify the value for an entity rule in each service rather than in the template. This is useful if each service linked to the template will be monitoring different entities. For example, you could specify
matches a value defined in the service. Then, after the services have been synced with the template, specify the value for
vm_namein each service. These options are particularly useful if you plan to bulk import services and link them to the template.
If you use the configurable entity rules described above and choose to Overwrite Entity Rules when you save the service template, any entity rules already defined in the linked services will be replaced with the entity rules from the template and they will have blank values (matching all entities).
- On the KPI tab, add, modify, or delete the KPIs in the template, and set KPI thresholds as desired. Any KPIs you add to the template must use a base search. Template KPIs cannot use ad hoc, metrics, or data model searches.
You cannot enable anomaly detection in a service template. You must enable anomaly detection for a KPI in the service directly.
- On the Settings tab, set importance values for the KPIs and see how they affect the health score of linked services.
- When you finish making modifications to the service template, click Save.
- In the Save Service Template dialog box, indicate what information to update and select when to push the changes to the linked services.
Setting Description Overwrite Entity Rules Replaces the entity rules in the linked services with the entity rules in the template. Overwrite KPI Thresholds on Choose whether to update KPI thresholds. If you have customized some of the KPI thresholds in your services and you want to keep these thresholds, select All Unchanged KPIs. To overwrite customized KPI thresholds in linked services, select All KPIs. This setting does not affect KPI thresholds for any KPIs that are unique to the service and not linked to the template. Overwrite Health Score Calculation Replaces the KPI importance values that are used to calculate the health score in the linked services with the KPI importance values from the template. KPI importance values for any additional KPIs in the service that are not present in the template are not affected. KPI importance values for dependent services are also not affected. Push changes to services Choose to push the changes immediately, or select Later to choose a date and time to update the linked services. It is usually recommended to push changes to services outside of regular business hours to avoid disruption.
- Click Save. The changes in the template are immediately propagated to the linked services if you chose to push the changes now or at the date and time you selected.
- Click the Linked Services tab to see the sync status of the services linked to the template.
After the linked services are synced with the template, the status says Synced. If you elected to push the changes now, you might need to refresh your browser to see the status change. You will also receive a message in Splunk Web with the status of the sync.
You can only schedule one sync for a service template. If you make additional updates to a service template that is already scheduled, you can keep the scheduled time (the default) or choose to sync now or at a different time. All updates that have been made to the template are pushed at the time you choose.
Create a service template in ITSI
Link a service to a service template in ITSI
This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.1.0, 4.1.1, 4.1.2, 4.1.5