Retire entities in ITSI
When an entity stops sending data to Splunk IT Service Intelligence (ITSI), the system still appears as an entity in ITSI until you manually delete the entity. Create an entity lifecycle management policy to identify entities that have not sent data based on your configured criteria. You can then use the results of the entity management policy to selectively retire these entities. Entities identified by the policy are marked with the yellow warning icon on the Entity Management page. Retire entities from ITSI to control the infrastructure components that you want to actively analyze, and improve the performance of your environment. Retired entities will not affect KPI searches.
Entities created manually, imported via one-time bulk import, or imported via recurring import can be marked for retirement. Entities imported with a recurring import that are marked as active or unstable won't be marked as eligible for retirement.
|ITSI roles||You must have the itoa_admin role and have read/write access to the Global team. For more information, see Configure users and roles in ITSI in the Administration Manual.|
Follow these steps to identify the entities that are good candidates for retirement.
Step 1. Create an entity management policy
Create a policy that generates a saved search which evaluates entities in your environment that are eligible for retirement. The search checks the ITSI metrics summary index
itsi_summary_metrics within your configured lookback period to determine whether an entity has recently contributed to KPI or service health scores. You can also toggle a setting to automatically retire entities that are identified by your policy criteria, so that you no longer have to manually retire or bulk retire your entities from the Entities page.
- From the ITSI main menu, go to Configuration > Entity Management.
- Select the Entity Management Policies tab and click Create Policy.
- Configure these fields in the modal:
Field name Description Policy Title Enter a unique name per entity policy. Retire an entity if it has not sent data in Retires an entity if the entity has not contributed to a KPI or service health score during a specified time period, and has an N/A or Inactive status. Evaluate Entities Evaluates whether an entity has contributed to a KPI or service health score calculation based on a set recurring schedule.
There is a maximum lookback period of 10 days (240 hours).
Entity Types (Optional) Filter only for the specific entity types specified in this field. You can only use one entity type per rule, per policy. Auto-retire Enable this setting to automatically retire the entities that are identified for retirement based on your policy criteria. This setting is disabled by default. Policy Status Toggle this setting to enable or disable the policy after creating it. Policies are disabled by default.
- Click Save. You can enable or disable a policy by toggling the setting under the Status column.
There can only be one policy assigned to a single entity type. You can't create more than one policy for the same entity type, or create more than one policy that evaluates all entities in your system.
Step 2. Retire your entities
The entity management policies you create run a search against the ITSI metrics summary index that checks whether an entity has contributed to a KPI or service health score. Entities that have not contributed data based on the time period specified in your entity management policy are flagged with a yellow warning icon , and these entities are good candidates for retirement.
Retired entities are no longer associated with services or KPIs and are treated as if you deleted them from your system. Any KPIs associated with retired entities display an N/A value on the Service Analyzer. Additionally, retired entities are removed from existing entity rules in your service definitions, and can't be added to new entity rules. When backing up ITSI, retired entities won't be included as part of the backup.
Follow these steps to retire your entities.
Note: If you enabled the Auto-retire toggle while creating your entity management policy, this setting automatically retires the entities that are identified for retirement by your policy. You will not have to manually retire these entities.
- Select the Entities tab on the Entity Management' page.
- To delete a single entity, click Edit > Retire Entity from the entity's row. To retire entities in bulk, select the check box to the left of each entity that you want to retire, and then click Bulk Action > Retire selected.
- (Optional) If you want to retire all entities marked for retirement at once, select the Retire Applicable Entities button. You can retire large numbers of entities with this option. This will retire all entities that are no longer actively sending data, and cannot be cancelled once started.
- (Optional) You can filter only for entities that are marked for retirement by selecting View > Retirable.
Step 3: View and restore retired entities
When you restore a retired entity, all previous settings are restored and the entity continues to exist in your system. The entity will be added to any associated services and entity rules. Follow these steps to restore previously retired entities, and/or verify that your entities were actually retired.
- From the ITSI main menu, go to Configuration > Entities.
- Select the Retired Entities tab to view a list of all entities that were recently retired.
- (Optional) To restore a retired entity, select the entity you want to restore and click Edit > Unretire.
Resolve conflicts during ITSI entity imports
Manually delete entities you don't want to analyze in ITSI
This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.12.0 Cloud only, 4.12.1 Cloud only, 4.13.1