Resolve conflicts during ITSI entity imports
When you import entities from CSV or search, you have to select a conflict resolution type and a conflict resolution field. The conflict resolution field is the field you want to use to identify entities. Entities that have the same value for the conflict resolution field are considered to be the same entity. The conflict resolution type determines how ITSI updates and stores your entity data. The following examples demonstrate the behavior of each conflict resolution type.
Skip Over Existing Entities
The Skip Over Existing Entities conflict resolution type adds new entity data to the datastore only if the entity does not already exist. If an entity exists, the information is not updated.
For example, if you import the following CSV file and you use
title as the Conflict Resolution field, if
Server_2 already exist as entities, they are not updated with the imported data. If no entities already exist with a title of
Server_2, these entities are created from the imported data.
title, IP, host Server_1, 192.168.1.1, somehostName Server_2, 192.168.2.2, anotherhostName
Update Existing Entities
The Update Existing Entities conflict resolution type merges the Alias and Info fields of imported entities with existing entities. Entities that have the same value in the Conflict Resolution field are treated as the same entity:
- Each entity that matches the Conflict Resolution field value receives the merged field values.
- If the Conflict Resolution field doesn't exist in the existing entity, the existing entity isn't affected.
- If the Conflict Resolution field doesn't exist in the CSV or search data, the row data isn't imported.
- If the Conflict Resolution field is an Alias field, but in the existing entity the field is an Info field, the existing Info field is preserved.
- If the Conflict Resolution field is an Info field, but in the existing entity the field is an Alias field, the existing Alias field is preserved.
In this example, the entities in the first example are created and now you import the following updated entity information using
title as the Conflict Resolution field:
title, IP, host Server_1, 192.168.1.1, somehostName Server_2, 192.168.2.3, anotherhostName
Server_2 will now have two IP addresses,
192.168.2.3, while no new data is added to
Replace Existing Entities
The Replace Existing Entities conflict resolution field replaces existing entity data with new entity data. Entities that have the same value in the Conflict Resolution field are treated as the same entity. For example, you can import this entity information using
title as the Conflict Resolution field using the following syntax:
title, IP, host Server_1, 192.168.1.2, somehostName2 Server_2, 192.168.2.2, anotherhostName2
Server_2entities, which already exist, are replaced with the new entity definitions for
Server_2in the import. The old Alias and Info fields for the entities are replaced with the ones in the import, so
Server_1 now has an IP of
192.168.1.2 and a host of
Server_2 now has an IP of
192.168.2.2 and a host of
Example of using a Conflict Resolution field other than Entity Title with Update Existing Entities option
For example, say you have two hosts with the same name in different data centers. You import the following columns:
|Entity Title (Name)||Information Field|
If you use the
host column (Entity Title) as the Conflict Resolution field, and use the Update Existing Entities option, one entity is created because both entities have the same value for host.This means they are treated as the same entity. After importing, entity A contains both A and B values for
datacenter as shown in this table:
|Entity Title (Name)||Alias||Information Field|
If instead you use the
datacenter column (Entity Information Field) as the Conflict Resolution field with the Update Existing Entities option, two entities will be created: the first entity A will be created with an Information field of
datacenter=A and a second entity A will be created with
datacenter=B as shown below.
|Entity Title (Name)||Alias||Information Field|
Generate pseudo entities in ITSI
Manually delete entities you don't want to analyze in ITSI
This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.5.0 Cloud only, 4.5.1 Cloud only, 4.6.0 Cloud only, 4.6.1 Cloud only, 4.6.2 Cloud only, 4.7.0, 4.7.1, 4.7.2, 4.7.3, 4.7.4, 4.8.0 Cloud only, 4.8.1 Cloud only, 4.9.0, 4.9.1, 4.9.2, 4.9.3, 4.9.4, 4.9.5, 4.9.6, 4.10.0 Cloud only, 4.10.1 Cloud only, 4.10.2 Cloud only, 4.10.3 Cloud only, 4.10.4 Cloud only, 4.11.0, 4.11.1, 4.11.2, 4.11.3, 4.11.4, 4.11.5, 4.11.6, 4.12.0 Cloud only, 4.12.1 Cloud only, 4.12.2 Cloud only, 4.13.0, 4.13.1, 4.13.2, 4.14.0 Cloud only, 4.14.1 Cloud only, 4.14.2 Cloud only, 4.15.0, 4.15.1, 4.16.0 Cloud only
Feedback submitted, thanks!