Share data in Splunk IT Service Intelligence

When Splunk IT Service Intelligence is deployed on Splunk Enterprise, the Splunk platform sends usage data to Splunk Inc. ("Splunk") to help improve Splunk IT Service Intelligence in future releases. For information about how to opt in, and how the data is collected, stored, and governed, see Share data in Splunk Enterprise.

What data is collected

Splunk IT Service Intelligence collects the following basic usage information:

Component	Description	Example
app.ITSI.performanceMetrics	Reports the time taken for a specific method to finish and non-identifiable supporting parameters to clean up the data (measured per 24 hours).	{ app: itsi component: app.ITSI.performanceMetrics data: { averageTime: 1.6168572306632996 cumulativeTime: 6.467428922653198 medianTime: 1.1328552961349487 method: itoa_object.get_bulk numberOfObjects: 1012 numberOfTransactions: 4 p90Time: 2.975279831886292 } deploymentID: 616ee3e9-532b-5b32-8679-0e58f7d3d336 eventID: 9157E0BA-1A2A-48CC-A738-66AB5E5DEE33 executionID: 38A07E6C-2CA7-4B6A-88DB-CB8ED52776D7 optInRequired: 3 timestamp: 1592906482 type: aggregate visibility: [ support anonymous ] }
app.ITSI.entityTypes	Reports the number of entities for each entity type (custom entity types are hashed).	{ app: itsi component: app.ITSI.entityTypes data: { countOfAssociatedEntities: 10 entityTypeIds: a0745f7ed88cfac6058d1d4cfb57bc71127a28ad7c6756004142a90aab5ee99f } deploymentID: 417a2431-e14d-5550-b3dc-8d72442dc74a eventID: 51F77E4B-D866-49FB-B2F5-463258AC9FC7 executionID: 661BB29D-A390-4B40-B17C-E5EFF48EE183 optInRequired: 3 timestamp: 1592820124 type: aggregate visibility: [ anonymous support ] }
app.ITSI.entityTypeToEntityRatio	Ratio of in-use entity types to entities.	{ app: itsi component: app.ITSI.entityTypeToEntityRatio data: { entityTypeToEntityRatio: 0.0007955449482895784 numberOfEntities: 5028 numberOfEntityTypes: 4 } deploymentID: 616ee3e9-532b-5b32-8679-0e58f7d3d336 eventID: BAC39F03-20BB-4D88-969F-072A9237581A executionID: 38A07E6C-2CA7-4B6A-88DB-CB8ED52776D7 optInRequired: 3 timestamp: 1592906593 type: aggregate visibility: [ support anonymous ] }
app.ITSI.serviceToEntityRatio	Reports the ratio of in-use services to entities.	{ app: itsi component: app.ITSI.serviceToEntityRatio data: { numberOfEntities: 128 numberOfServices: 8 serviceToEntityRatio: 0.0625 } deploymentID: 639ae7f7-0af0-5a0f-b053-65a3662f230a eventID: 6A71F467-B4FE-4D4C-99F4-4F324DD01B72 executionID: EC2EE972-58C2-441F-97B9-8921453AC341 optInRequired: 3 timestamp: 1592820188 type: aggregate visibility: [ anonymous support ] }
app.ITSI.kpiToEntityRatio	Reports the ratio of in-use KPIs to entities.	{ app: itsi component: app.ITSI.kpiToEntityRatio data: { kpiToEntityRatio: 0.20689655172413793 numberOfEntities: 87 numberOfKpis: 18 } deploymentID: 121370bf-b9ce-54c5-96e0-f99a03242ef5 eventID: 3341F59D-8290-4683-B4A9-3F7C09458CB3 executionID: CC1CAA21-78DD-46C5-BEAA-5BFD690100E3 optInRequired: 3 timestamp: 1592733807 type: aggregate visibility: [ anonymous support ] }
app.ITSI.sharedBaseSearchToEntityRatio	Reports the ratio of in-use shared base searches to entities.	{ app: itsi component: app.ITSI.sharedBaseSearchToEntityRatio data: { numberOfEntities: 25080 numberOfSharedBaseSearches: 5 sharedBaseSearchToEntityRatio: 0.00019936204146730463 } deploymentID: 616ee3e9-532b-5b32-8679-0e58f7d3d336 eventID: 8F418716-926D-4D67-B31A-3732DBC4EC21 executionID: 38A07E6C-2CA7-4B6A-88DB-CB8ED52776D7 optInRequired: 3 timestamp: 1592906664 type: aggregate visibility: [ support anonymous ] }
app.ITSI.serviceAssociatedEntityToServiceUnassociatedEntityRatio	Reports the number of entities by service association.	{ app: itsi component: app.ITSI.serviceAssociatedEntityToServiceUnassociatedEntityRatio data: { numberOfServiceAssociatedEntities: 5016 numberOfServiceUnassociatedEntities: 12 serviceAssociatedEntityToServiceUnassociatedEntityRatio: 418 } deploymentID: 616ee3e9-532b-5b32-8679-0e58f7d3d336 eventID: 965EC96C-33E4-44E2-B885-77CE071D3EEC executionID: 38A07E6C-2CA7-4B6A-88DB-CB8ED52776D7 optInRequired: 3 timestamp: 1592906664 type: aggregate visibility: [ anonymous support ] }
app.session.ITSI.pageLoad	Reports the time taken for a React component to load with associated metadata.	{ component: app.session.ITSI.pageLoad data: { app: itsi loadTime: 18398.775000008754 metadata: { activeTabId: EVENT_DATA_SEARCH isInitialAppMount: true } mode: development page: entity_detail } deploymentID: 2b623070-88c3-51a2-bed6-8dd666600c60 eventID: 768b9773-57c9-9549-5527-9346c7568899 experienceID: 8268d610-95d7-5a6d-4e3e-c5ad9f561a5b optInRequired: 3 timestamp: 1592356630 userID: 5f4dba230c6b7e300aec79ea85261914c069f777452a207f26b56fb185892b27 version: 4 visibility: anonymous,support }
app.session.pageView	Reports the pages a user has visited.	{ component: app.session.pageview data: { app: itsi page: notable_event_aggregation_policy_detail_view } deploymentID: 0e55c2be-a373-5e5f-b9cf-34f0977566e1 eventID: e4df5657-d13f-8f66-3958-21f0e4247439 experienceID: 6cac0958-68e6-5a3b-631a-c7f407794280 optInRequired: 3 timestamp: 1592850392 userID: 36966f73a802b0f3e37b385983f3d21d556b0c9d5e2e4bcd9163526bafe12320 version: 4 visibility: anonymous,support }
app.session.udf.telemetry	Reports information about visualizations and configurations that users implement in beta glass tables.	component: app.session.udf.telemetry data: { [-] app: itsi definition: { [-] inputs: { [-] input1: { [-] options: { [-] items: 3 } titleLength: 6 type: input.dropdown } } layout: { [-] globalInputs: [ [-] input1 ] options: { [-] height: 750 width: 1300 } structure: [ [-] { [-] item: viz_eGQh2uAJ position: { [-] h: 730 w: 1280 x: 10 y: 10 } type: block } { [-] item: viz_2WcVmXz0 position: { [-] h: 450 w: 770 x: 260 y: 20 } type: block ] type: absolute } titleLength: 26 visualizations: { [-] viz_2WcVmXz0: { [-] options: { [-] preserveAspectRatio: true src: true } type: viz.img } viz_5HKW2R1q: { [-] options: { [-] legend.placement: top } titleLength: 29 type: viz.line } } } definitionInfo: { [-] componentCounts: { [-] dataSourceTypeCounts: { [-] ds.test: 11 } inputTypeCounts: { [-] input.dropdown: 1 } vizTypeCounts: { [-] abslayout.line: 6 viz.img: 1 viz.line: 2 viz.rectangle: 1 viz.singlevalue: 8 viz.table: 1 viz.text: 3 } } numDataSources: 11 numInputs: 1 numViz: 22 } page: boston_marathon__absolute__k0wxyjod/edit pageAction: dashboard.initialize udfVersion: 5.2.0 } deploymentID: e5fc210a-8e27-54b6-b50e-306304917a3f eventID: 40c251b1-09ad-cb2d-cb64-c503c8e91695 experienceID: 10fa783d-65c5-0ece-9808-416f92ccfd48 timestamp: 1569281682 userID: 0b9a7eef9855fe028ae96a4eeea30356bdd66dfeeae10002503a6e7dd9be0e92 version: 3 visibility: anonymous,support
app.ITSI.entityLifecycleManagement	Number of entity lifecycle management policies having auto retire feature enabled on the Splunk system.	{ "timestamp":1648091047, "component":"app.ITSI.entityLifecycleManagement", "executionID":"64FB8F4D-5BB9-4D0E-9549-5E5FFFD883C8", "data":{ "countOfRetirableEntities":0, "countOfEntityTypesUnderManagement":3, "countOfDisabledEntityManagementPolicies":9, "countOfEnabledEntityManagementPolicies":1, "countOfEntitiesUnderManagement":2, "countOfRetiredEntities":2, "countOfAutoRetireEntityManagementPolicies":1, "avgPolicyRunTime":4.65, "avgPolicyLookbackPeriod":26 }, "optInRequired":3, "visibility":[ "anonymous", "support" ], "eventID":"0F66ABC6-83C4-4CD2-B762-415D2B2474DD", "type":"aggregate", "deploymentID":"91182b71-8c10-5019-8daa-6722bac9bc27", "app":"itsi" }
app.ITSI.calculationWindowUsage	Information about the types of calculation windows in ITSI.	{ app: itsi component: app.ITSI.calculationWindowUsage data: { customWindow: { calculationWindowValueCount: [ { calculationWindowValue: 33 count: 1 } ] totalCount: 1 } predefinedWindow: { calculationWindowValueCount: [ { calculationWindowValue: 5 count: 8 } ] totalCount: 8 } } deploymentID: a3b9b625-8392-5205-b4e8-350dd0491cbb eventID: 4ECEA390-74EB-48CF-B387-3808D68A7A3B executionID: 110B8DAD-B7F2-4E8B-8CB2-43390A8A253A optInRequired: 3 timestamp: 1665082511 type: aggregate visibility: [ anonymous support ] }
app.ITSI.knowledgeObjectsCounts	Provides a count of various knowledge objects in ITSI.	{ "data":{ "knowledgeObjects":{ "authoredContentPacks": { "totalCount": 1 }, "eventManagementStates":{ "totalCount":6, "privateCount":0, "publicCount":6 }, "glassTables":{ "privateCount":0, "publicCount":2, "totalCount":2 }, "contentPacks":{ "totalCount":1, "DA-ITSI-CP-CUST-63929313c0755967941cb2cd":1 }, "services":{ "kpis":{ "adhocCount":2, "totalCount":1013, "sharedBaseSearchCount":1011, "dataModelCount":0, "metricsCount":0 }, "dependServicesCount":86, "servicesLinkedToATemplate":96, "totalCount":96, "servicesNotInGlobal":2 }, "deepDives":{ "publicCount":1, "privateCount":1, "totalCount":2 }, "correlationSearches":{ "totalCount":7 }, "maintenanceWindows":{ "totalCount":0 }, "homeViews":{ "privateCount":0, "totalCount":11, "publicCount":11 }, "entityManagementRules":{ "totalCount":1 }, "kpiBaseSearches":{ "totalCount":99 }, "entityManagementPolicies":{ "totalCount":0 }, "authoredContentPacks":{ "totalCount":1 }, "entityTypes":{ "totalCount":10 }, "entities":{ "totalCount":2216 }, "kpiTemplates":{ "totalCount":33 }, "notableEventAggregationPolicies":{ "totalCount":6 }, "customThresholdWindows":{ "totalCount":0 }, "kpiThresholdTemplates":{ "totalCount":36 }, "teams":{ "totalCount":5 }, "serviceTemplates":{ "totalCount":10 } } } }
app.ITSI.ATUsage	Provides a count of KPIs with thresholds generated by Splunk AI, and services using adaptive thresholding or using KPIs that have thresholds generated by Splunk AI.	{ "timestamp": 1633320026, "component": "app.ITSI.ATUsage", "executionID": "ECF66CEF-00EC-4EB3-817A-C0CF6A24C24F", "data": { "kpis_using_at": 170, "kpis_using_policies": { "percentage": 4, "stdev": 124, "static": 51, "range": 1, "quantile": 3 }, "kpis_using_threshold_templates": { "kpi_threshold_template_3_stdev": 104, "kpi_threshold_template_3_quantile": 2, "kpi_threshold_template_2_stdev": 2, "kpi_threshold_template_8_stdev": 1 }, "kpis_using_custom_thresholds": 61, "kpis_using_recommendation": 0, "kpis_with_recommendations_modified": 0, "services_using_at": 117, "services_using_custom_thresholds": 16, "services_using_recommendation": 0, "services_with_recommendations_modified": 0, "min_threshold_level": { "percentage": 0, "stdev": -12.18, "range": 0, "quantile": 0 }, "max_threshold_level": { "percentage": 90, "stdev": 12.18, "range": 0.75, "quantile": 0.97 } }, "optInRequired": 3, "visibility": [ "anonymous", "support" ], "eventID": "FAA1804F-F2C5-47A1-B06B-DED1CB31F252", "type": "aggregate", "deploymentID": "91182b71-8c10-5019-8daa-6722bac9bc27", "app": "itsi" }
app.session.ITSI.componentInteraction	Tracks user interactions with various UI elements to understand how users accomplish a specific goal.	{ "optInRequired":3, "visibility":"anonymous,support", "experienceID":"166287aa-3c8d-fdd0-a17f-90aa0fe39596", "version":"4", "timestamp":1691621685, "data":{ "itsiComponent":"ServiceSandbox", "page":"service_sandbox", "action":"Save", "app":"itsi", "numberOfChangesApplied":2 }, "splunkVersion":"9.0.0", "component":"app.session.ITSI.componentInteraction", "eventID":"1f4f5b55-55f7-fb0a-3559-b1cfe78b0734", "deploymentID":"68058ae0-9a56-55f0-bf4b-dd603e22c7aa", "original_timestamp":1691621685, "original_event_id":"76e9282e78b0fc8cec7a2a6358967360d6638f54f4abab8a1770aea10d1d5a3e", "userID":"28586f93ca33c3ae5365473820acf0230abdcb1481e955eea288a99291d81bd4" }
app.ITSI.performanceMetrics	Measures amount of time taken by specific backend functions.	{ app: itsi component: app.ITSI.performanceMetrics data: { averageTime: 0.01605749130249 cumulativeTime: 0.03211498260498 medianTime: 0.01605749130249 method: validate_sandbox numberOfTransactions: 2 p90Time: 0.016411876678467 } deploymentID: e950e291-0ffc-5b55-9435-c43caa398d95 eventID: 78D10842-382A-4A2D-9970-CDE81F738FBE executionID: 15BEDE8E-6FEC-4C3C-9C17-42E18448157D optInRequired: 3 original_event_id: d9407d4db9c3aed0194d5ef4fd5c5bceb28097e5088d154f0f0c29cb713746e5 original_timestamp: 1696363278 timestamp: 1696363278 type: aggregate visibility: [ anonymous support ] }
app.ITSI.entityDiscoverySearchCleanupCommand	Information about when the CleanupEntityDiscoverySearches command is used.	{ app: itsi component: app.ITSI.entityDiscoverySearchCleanupCommand data: { cleaned_entities: 5 end_time_int: 1696343197.1711 has_error: 0 host: ash-vm1 roles_for_current_user: ['admin'] start_time_int: 1696343195.432 tid: db50487861f811eeb32c00505696f8f7 } deploymentID: 7e475054-ba16-51d7-8ea5-c5a7856b6e64 eventID: 585DDA3D-7EDB-4378-B2DA-1DD9DC606E1C executionID: 8C7FFB2E-2FE6-491A-96F2-D15EAD14FCB7 optInRequired: 3 original_event_id: ecfe876186665569e1223b1373f223bcacd22593992bf179ff4a44780f2890e5 original_timestamp: 1696384807 timestamp: 1696384807 type: aggregate visibility: [ anonymous support ] }