Edit or remove the default module content shipped with ITSI
IT Service Intelligence (ITSI) ships with preconfigured module base searches and SAI service templates. By default, you can't tune the base searches and service templates to fit your environment. This topic describes how to make this content editable so you can tune it through the UI. You can also choose to remove this content if you never use it.
The following instructions pertain to a standalone search head deployment. If you have a search head cluster environment, you must make the file changes on the deployer and deploy them to cluster members. Make all UI changes on the individual cluster members.
Prerequisites
- Only users with file system access, such as system administrators, can remove module base searches and service templates.
- Begin with a full installation of ITSI. Make sure that all add-ons and their configuration files are intact.
Steps
The changes described in this section don't persist through an ITSI upgrade. After you make these changes, follow the instructions in the next section during future upgrades.
- To make SAI content editable, open
$SPLUNK_HOME/etc/apps/SA-ITOA/default/itsi_base_service_template.conf
and remove all lines reading_immutable = true
- Restart Splunk software. During the restart, each KV store artifact that originated from an ITSI add-on is updated to allow write access.
- (Optional) Verify that the changes worked by removing an unused ITSI KPI base search. For example
DA-ITSI-EUEM*
. - Remove the following configuration files that load the preconfigured content into the KV store:
cd $SPLUNK_HOME/etc/apps/ rm DA-ITSI-*/default/itsi_kpi_template.conf rm DA-ITSI-*/default/itsi_kpi_base_search.conf rm DA-ITSI-*/default/itsi_service_template.conf rm SA-ITOA/default/itsi_base_service_template.conf rm SA-ITOA/default/itsi_kpi_base_search.conf
- Restart Splunk software.
The module-provided KPI base searches and SAI service templates are now fully editable. You can tune these base searches as desired.
It's a best practice to remove unwanted KPI base searches and service templates. The UI prevents the inadvertent removal of any base search that is currently in use.
Prevent content from loading during future upgrades
For new environments, or for environments where you've already performed the steps above, follow these instructions during all future installations and upgrades to prevent immutable content from reloading.
- Stop your Splunk software.
- Install or upgrade ITSI. Do not start Splunk software after the install or upgrade completes.
- Remove the following configuration files:
cd $SPLUNK_HOME/etc/apps/ rm DA-ITSI-*/default/itsi_kpi_template.conf rm DA-ITSI-*/default/itsi_kpi_base_search.conf rm DA-ITSI-*/default/itsi_service_template.conf rm SA-ITOA/default/itsi_base_service_template.conf rm SA-ITOA/default/itsi_kpi_base_search.conf
- Start your Splunk software.
ITSI module release notes |
This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.11.0, 4.11.1, 4.11.2, 4.11.3, 4.11.4, 4.11.5, 4.11.6, 4.12.0 Cloud only, 4.12.1 Cloud only, 4.12.2 Cloud only, 4.13.0, 4.13.1, 4.13.2, 4.13.3, 4.14.0 Cloud only, 4.14.1 Cloud only, 4.14.2 Cloud only, 4.15.0, 4.15.1, 4.15.2, 4.15.3, 4.16.0 Cloud only, 4.17.0, 4.17.1, 4.18.0, 4.18.1
Feedback submitted, thanks!