Splunk® IT Service Intelligence

Administration Manual

Schedule maintenance downtime in ITSI

Schedule maintenance downtime in IT Service Intelligence (ITSI) to prevent alerts from triggering from machines and other devices that are undergoing maintenance operations or don't require active monitoring. Defining maintenance windows for scheduled downtimes, such as during server or software upgrades, reduces unnecessary noise. For more information about maintenance windows and their impact on ITSI objects, see Overview of maintenance windows in ITSI.

For example, if your ticketing system experiences a failure and you start to receive a cascade of identical notable events, you can put the service monitoring the ticketing system into maintenance mode to stop ITSI from generating alerts until the issue is resolved.

Maintenance windows apply to services and entities. You cannot schedule recurring maintenance windows. You can only see maintenance windows that contain at least one service or entity you have read access to. If you have only read permissions for the services or entities in a maintenance window, you can view the maintenance window but not edit it.

If you're bulk deleting maintenance windows, you can only delete the maintenance windows that contain services or entities for which you have write access.


Only users assigned the write-maintenance_calendar capability as well as write access to the Global team can create a maintenance window. By default, the itoa_admin and itoa_team_admin roles have this capability.


  1. From the ITSI top menu bar, click Configuration > Maintenance Windows.
  2. Click Create Maintenance Window.
  3. Provide a title for the maintenance window. For example, "DB entity maintenance window."
  4. Set the start time, duration, and end time for the maintenance window.
  5. Select the Objects for which you want to create a maintenance window: Entities or Services.

    If you don't have write access to the Global team, you can't put entities into maintenance mode.

  6. Click Next.
  7. Select the specific services or entities that you want to place in maintenance mode for the duration of the maintenance window. You can only select services or entities for which you have write access.
  8. Click Create. The selected entities or services enter maintenance mode according to the defined schedule.
Last modified on 20 October, 2023
Overview of maintenance windows in ITSI   Overview of backing up and restoring ITSI KV store data

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.11.0, 4.11.1, 4.11.2, 4.11.3, 4.11.4, 4.11.5, 4.11.6, 4.12.0 Cloud only, 4.12.1 Cloud only, 4.12.2 Cloud only, 4.13.0, 4.13.1, 4.13.2, 4.13.3, 4.14.0 Cloud only, 4.14.1 Cloud only, 4.14.2 Cloud only, 4.15.0, 4.15.1, 4.15.2, 4.15.3, 4.16.0 Cloud only, 4.17.0, 4.17.1, 4.18.0, 4.18.1, 4.19.0

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters