Overview of service templates in ITSI
Service templates in IT Service Intelligence (ITSI) help you manage services in bulk. Any changes you make to a template are propagated to all linked services. For example, if you add a KPI to a service template, it is added to all the linked services. You can still configure KPIs and entity rules that are unique to a service directly in the service.
Service templates help you perform the following tasks:
- Create a service and automatically populate the KPIs and entity rules. See Create a service from a service template in ITSI
- Bulk import services and link them to a service template. See Link and unlink services from service templates in ITSI.
You can also use the ITSI REST API to link services to service templates. It is best practice to create the service on which to base the template in the UI rather than creating the service through the ITSI REST API. See itoa_interface/service/<_key>/base_service_template in the ITSI REST API Manual for information.
You can control how the following updates are propagated to linked services:
|Entity rules||Whether to overwrite the rules in the linked services or not.|
|KPI threshold templates||Whether to update the threshold templates for all KPIs, no KPIs, or only unchanged KPIs in the linked services.|
|Health score||Whether to overwrite the KPI importance values in the linked services with those in the template. This setting doesn't affect any additional or dependent KPI importance values.|
How service templates differ from services
Service templates differ from services in the following ways:
- Templates don't contain a service health score.
- Template KPIs can only use a base search, not ad hoc or data model searches.
- Templates don't have service dependencies. You must define dependencies in individual services.
- Templates allow entity values to be defined in the linked services rather than in the template. These are known as configurable entity rules.
- You can't enable anomaly detection for KPIs in a template. You must manually enable it for KPIs in individual services.
Service templates exist in the Global team. You must have write access to the Global team and the
write_itsi_base_service_template capability to create and manage service templates. By default, only the itoa_admin possesses this capability. For more information, see ITSI capabilities reference in the Administration Manual.
Team admins, or users with a role that inherits from the itoa_team_admin role, can create services for their teams using service templates. The same template can be used for services in different teams. Dependent services don't have to be linked to the same service template as the parent service. For more information, see Overview of teams in ITSI.
Performance and scaling
The higher the number of services linked to a service template, the higher the number of KPIs that use the same base search. For example, if a service template has ten KPIs and is linked to twelve services, each KPI base search in the template is being used twelve times, once for each of the linked services.
If the same KPI base search is used by too many services, this can lead to performance issues. For more information, see KPI base search performance considerations.
To start, create one or more service templates in your ITSI environment. To do so, you must create a service and then create a service template from it. For instructions, see Create a service template in ITSI.
Aggregate versus maximum severity KPI values in ITSI
Create a service template in ITSI
This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.11.0, 4.11.1, 4.11.2, 4.11.3, 4.11.4, 4.11.5, 4.11.6, 4.12.0 Cloud only, 4.12.1 Cloud only, 4.12.2 Cloud only, 4.13.0, 4.13.1, 4.13.2, 4.13.3, 4.14.0 Cloud only, 4.14.1 Cloud only, 4.14.2 Cloud only, 4.15.0, 4.15.1, 4.15.2, 4.15.3, 4.16.0 Cloud only, 4.17.0, 4.17.1