Update a service template in ITSI

When you update a service template in IT Service Intelligence (ITSI), it updates all services linked to the template. You can choose to push updates immediately or schedule a specific date and time to push the updates. For more information about service templates, see Overview of service templates in ITSI.

Prerequisite

You must have the write_itsi_base_service_template capability and write access to the Global team to update a service template. Users with the itoa_admin role have this capability by default.

Steps

1. From the ITSI main menu, click Configuration > Service Templates.
2. Open a service template.
3. Modify the service template settings on the following tabs:

   Tab	Description
   Entities	Add, modify, or delete entity rules. Use the following options to specify the value of an entity in each service rather than in the template: matches a value to be defined in the service does not match a value to be defined in the service These settings are useful if each service linked to the template monitors different entities. If you use matches a value to be defined in the service or does not match a value to be defined in the service to define entities and choose Overwrite Entity Rules when you save the service template, any entity rules already defined in the linked services are replaced with the entity rules from the template and have blank values (matching all entities). Matching entities aren't displayed in the service template. You can view matching entities at the bottom of the Entities tab in the service definition. For more information, see Add entity rules to a service in ITSI.
   KPIs	Add, modify, or delete the template's KPIs. Any KPIs you add to the template have to use a base search. Template KPIs can't use ad hoc, metrics, or data model searches. For more information, see Create KPI base searches in ITSI.
   Settings	Modify tags as needed for the template. Adding or removing tags doesn't unlink the service from the template. For more information, see Add tags to a service in ITSI. Under Service Health Score enable or disable the Include Entities setting as needed. When enabled, entities can effect the health score due to the thresholding levels placed on the entity. Disable Include Entities if you want the KPI aggregate to determine the Service Health Score rather than a single entity. See Impact of per-entity thresholds on service health scores for more info. Modify the importance values for the KPIs on the Settings tab. For more information, see Set KPI importance values in ITSI.
   Linked services	The service you used to create the template is listed as a linked service. For more information, see Link and unlink services from a service template in ITSI.

4. When you finish making modifications to the service template, click Save.
5. Indicate what information to update and select when to push the changes to the linked services.

   Setting	Description
   Overwrite entity rules	Replaces the entity rules in the linked services with the entity rules in the template.
   Overwrite KPI thresholds and alerting rules on	How to update KPI thresholds and KPI alerting rules in linked services. Select All KPIs to overwrite all KPIs in all linked services, including any that you've customized since you last saved the template. Select All Unchanged KPIs if you customized some of the KPI thresholds or alerting rules in the linked services and you don't want to override those changes. Select No KPIs if you don't want to update any KPIs in the linked services. This setting doesn't affect thresholds or alerting rules for KPIs that are unique to a service and not linked to the template.
   Overwrite health score calculation	Replaces the KPI importance values used to calculate the health score in the linked services with the values from the template. KPI importance values for any additional KPIs in the service that are not present in the template are not affected. Importance values for dependent services are also not affected.
   Push changes to services	When to push the changes to the linked services. Either push the changes immediately, or select Later to choose a date and time to update the linked services. It is considered a best practice to push changes outside of regular business hours to avoid disruption.

6. Click Save. The changes in the template are immediately propagated to the linked services if you chose to push the changes now, or scheduled for the date and time you selected.
7. Click the Linked Services tab to see the sync status of the services linked to the template.

After the linked services are synced with the template, the status says "Synced". If you elected to push the changes now, you might need to refresh your browser to see the status change. You will also receive a message in Splunk Web with the status of the sync.

Service template syncs

You can only schedule one sync for a service template at a time. If you make additional updates to a template that's already scheduled for a sync, you can keep the scheduled time or choose to sync now or at a different time. All updates to the template are pushed at the time you choose. If the sync is scheduled for Now, it should only take several seconds before you see Sync in progress The total time of the sync depends on environment-specific factors such as the number of services and KPIs.

You can find out when a service template is scheduled to sync by checking the services lister page for the synced services that will be updated, or the service template lister page. If you need to force a service template sync, just make a dummy change to the template and push the changes. If the status says Pending it means the refresh queue is backed up.

The following cases are common causes of service templates not syncing properly:

• The sync is scheduled for a later time
• The sync is scheduled for a time in the past
• There are conflicts or mismatches in linked services
• A migration or restore is in effect

To check the logs for errors, you can run the following search:

index=_internal error "*sync failed*"