Troubleshooting modules

This topic discusses problems that can occur with data correlation in the ITSI modules and how to address those problems.

Troubleshooting entities

The following entity-related problems can occur with ITSI modules.

No entities appear when you attempt to define a new service

When you are unable to locate entities after you have configured data collection on entities, the problem has one of several root causes:

Configuration

You have not configured the technology add-on correctly on the host that you want module and KPI data from. This usually means you either have not installed the correct Splunk add-on on the machine, or have not configured the appropriate inputs within the Splunk add-on to send data.

Windows hosts must have the Splunk Add-on for Windows installed, and *nix hosts must have the Splunk Add-on for Unix and Linux installed. Additionally, these Splunk add-ons must have the correct input stanzas enabled before entities can show up in the service definition dialog in ITSI. To check whether the add-on is configured correctly, see Operating System Module configurations in this manual.

Connectivity

Before ITSI can display entity data, that data must be present on an indexer that ITSI has access to. If you don't see entity data for a host you have configured, consider the following:

1. Confirm that no firewall or physical network break blocks access between universal forwarder and indexer.
2. If entities data is slow or late to arrive, you might be experiencing network latency or network errors, or the entities on which the universal forwarder is installed might be experiencing performance issues (for example, CPU and disk).

Permissions

The Splunk user that uses the ITSI app must have specific permissions and access to indexes that ITSI uses. Otherwise entities don't appear.

Confirm that the user who accesses ITSI can see the indexes that store the data from the host technology add-ons. If that user does not have permission to view those indexes, no host data can appear.

ITSI data can be present in any of the following indexes:

• main
• os (from the Splunk Add-on for Unix and Linux)
• windows (from the Splunk Add-on for Windows)
• wineventlog (from the Splunk Add-on for Windows)
• perfmon (from the Splunk Add-on for Windows)

The Entity Details view is not available

If you are unable to see the Entity Details view from within ITSI even after you have defined entities and services, confirm the following:

• You are in the deep dive view in ITSI. The entity detail view only works in deep dives.
• You have enabled overlays in a deep dive lane.

The Entity Details view does not show all data on some panels

If you do not see all data on some panels of the Entity Details view, confirm that you have enabled the appropriate inputs in the technology add-on for the entity whose data is missing. Also confirm that you use the correct Splunk add-on for the entity in question and that the end-user viewing the data has the authorized to query the index where the performance data is stored.

Entities are slow to load

Data is unavailable, incomplete, or taking a long time to load. Entity data begins ingestion at service creation time and does not backfill. It takes about an hour to start seeing a full sparkline chart and for KPIs to become active. Drilldowns are Splunk searches that search across the log files and indexes for the time window assigned.

Troubleshooting metrics

The following metrics-related problems can occur with ITSI modules.

No data visible in modules

If you are having trouble viewing your data, run the data model audit to make sure your data models are processing your data.

Some KPIs do not populate

If you do not see some key performance indicators populate within ITSI after you define entities and services, confirm the following:

• You have configured the Splunk add-ons on a host properly. For details, including sample configuration files, see below.
• The logged-in user has access to the correct indexes. The user must be able to search the indexes before KPIs can populate.

Troubleshooting permissions

If a user encounters a permission-related obstacle, the issue could be related to their assigned role. ITSI permissions are determined by the role that each user has. Each role offers a different set of permissions.

ITSI access is broken down by the following roles:

User

Can use ITSI to view services, glass tables, and deep dives. Can create private glass tables or deep dives.

Analyst

User permissions, plus can own notable events.

Admin

Analyst permissions, plus can administer the entire ITSI system.

When a user clicks on a service from the module visualization page, the user's role determines what the user can do and view. By default, admin and analyst roles allow you to create, edit and delete services. Admin level access permissions are required to access the service configuration page.

To locate an existing user or role in Splunk Web, click Settings and select Users or Roles. Use the filter to search for an existing user or role.

Learn about adding navigation to a Splunk app.

Sample configuration files

Navigate to the sample configuration files in the Operating System Module troubleshooting section of the Splunk IT Service Intelligence Modules manual for the the Splunk Add-on for Windows and the Splunk Add-on for Unix and Linux sample configuration files that collect the data and metrics needed to generate the KPIs for the Operating System Module.

Copy and paste them into an inputs.conf file within the appropriate add-on on the host that you want to collect data.