Share data in Splunk IT Service Intelligence

When Splunk IT Service Intelligence is deployed on Splunk Enterprise, the Splunk platform sends usage data to Splunk Inc. ("Splunk") to help improve Splunk IT Service Intelligence in future releases. For information about how to opt in, and how the data is collected, stored, and governed, see Share data in Splunk Enterprise.

What data is collected

Splunk IT Service Intelligence collects the following basic usage information:

Component	Description	Example
app.ITSI.performanceMetrics	Reports the time taken for a specific method to finish and non-identifiable supporting parameters to clean up the data (measured per 24 hours).	{ app: itsi component: app.ITSI.performanceMetrics data: { averageTime: 1.6168572306632996 cumulativeTime: 6.467428922653198 medianTime: 1.1328552961349487 method: itoa_object.get_bulk numberOfObjects: 1012 numberOfTransactions: 4 p90Time: 2.975279831886292 } deploymentID: 616ee3e9-532b-5b32-8679-0e58f7d3d336 eventID: 9157E0BA-1A2A-48CC-A738-66AB5E5DEE33 executionID: 38A07E6C-2CA7-4B6A-88DB-CB8ED52776D7 optInRequired: 3 timestamp: 1592906482 type: aggregate visibility: [ support anonymous ] }
app.ITSI.entityTypes	Reports the number of entities for each entity type (custom entity types are hashed).	{ app: itsi component: app.ITSI.entityTypes data: { countOfAssociatedEntities: 10 entityTypeIds: a0745f7ed88cfac6058d1d4cfb57bc71127a28ad7c6756004142a90aab5ee99f } deploymentID: 417a2431-e14d-5550-b3dc-8d72442dc74a eventID: 51F77E4B-D866-49FB-B2F5-463258AC9FC7 executionID: 661BB29D-A390-4B40-B17C-E5EFF48EE183 optInRequired: 3 timestamp: 1592820124 type: aggregate visibility: [ anonymous support ] }
app.ITSI.entityTypeToEntityRatio	Ratio of in-use entity types to entities.	{ app: itsi component: app.ITSI.entityTypeToEntityRatio data: { entityTypeToEntityRatio: 0.0007955449482895784 numberOfEntities: 5028 numberOfEntityTypes: 4 } deploymentID: 616ee3e9-532b-5b32-8679-0e58f7d3d336 eventID: BAC39F03-20BB-4D88-969F-072A9237581A executionID: 38A07E6C-2CA7-4B6A-88DB-CB8ED52776D7 optInRequired: 3 timestamp: 1592906593 type: aggregate visibility: [ support anonymous ] }
app.ITSI.serviceToEntityRatio	Reports the ratio of in-use services to entities.	{ app: itsi component: app.ITSI.serviceToEntityRatio data: { numberOfEntities: 128 numberOfServices: 8 serviceToEntityRatio: 0.0625 } deploymentID: 639ae7f7-0af0-5a0f-b053-65a3662f230a eventID: 6A71F467-B4FE-4D4C-99F4-4F324DD01B72 executionID: EC2EE972-58C2-441F-97B9-8921453AC341 optInRequired: 3 timestamp: 1592820188 type: aggregate visibility: [ anonymous support ] }
app.ITSI.kpiToEntityRatio	Reports the ratio of in-use KPIs to entities.	{ app: itsi component: app.ITSI.kpiToEntityRatio data: { kpiToEntityRatio: 0.20689655172413793 numberOfEntities: 87 numberOfKpis: 18 } deploymentID: 121370bf-b9ce-54c5-96e0-f99a03242ef5 eventID: 3341F59D-8290-4683-B4A9-3F7C09458CB3 executionID: CC1CAA21-78DD-46C5-BEAA-5BFD690100E3 optInRequired: 3 timestamp: 1592733807 type: aggregate visibility: [ anonymous support ] }
app.ITSI.sharedBaseSearchToEntityRatio	Reports the ratio of in-use shared base searches to entities.	{ app: itsi component: app.ITSI.sharedBaseSearchToEntityRatio data: { numberOfEntities: 25080 numberOfSharedBaseSearches: 5 sharedBaseSearchToEntityRatio: 0.00019936204146730463 } deploymentID: 616ee3e9-532b-5b32-8679-0e58f7d3d336 eventID: 8F418716-926D-4D67-B31A-3732DBC4EC21 executionID: 38A07E6C-2CA7-4B6A-88DB-CB8ED52776D7 optInRequired: 3 timestamp: 1592906664 type: aggregate visibility: [ support anonymous ] }
app.ITSI.serviceAssociatedEntityToServiceUnassociatedEntityRatio	Reports the number of entities by service association.	{ app: itsi component: app.ITSI.serviceAssociatedEntityToServiceUnassociatedEntityRatio data: { numberOfServiceAssociatedEntities: 5016 numberOfServiceUnassociatedEntities: 12 serviceAssociatedEntityToServiceUnassociatedEntityRatio: 418 } deploymentID: 616ee3e9-532b-5b32-8679-0e58f7d3d336 eventID: 965EC96C-33E4-44E2-B885-77CE071D3EEC executionID: 38A07E6C-2CA7-4B6A-88DB-CB8ED52776D7 optInRequired: 3 timestamp: 1592906664 type: aggregate visibility: [ anonymous support ] }
app.session.ITSI.pageLoad	Reports the time taken for a React component to load with associated metadata.	{ component: app.session.ITSI.pageLoad data: { app: itsi loadTime: 18398.775000008754 metadata: { activeTabId: EVENT_DATA_SEARCH isInitialAppMount: true } mode: development page: entity_detail } deploymentID: 2b623070-88c3-51a2-bed6-8dd666600c60 eventID: 768b9773-57c9-9549-5527-9346c7568899 experienceID: 8268d610-95d7-5a6d-4e3e-c5ad9f561a5b optInRequired: 3 timestamp: 1592356630 userID: 5f4dba230c6b7e300aec79ea85261914c069f777452a207f26b56fb185892b27 version: 4 visibility: anonymous,support }
app.session.pageView	Reports the pages a user has visited.	{ component: app.session.pageview data: { app: itsi page: notable_event_aggregation_policy_detail_view } deploymentID: 0e55c2be-a373-5e5f-b9cf-34f0977566e1 eventID: e4df5657-d13f-8f66-3958-21f0e4247439 experienceID: 6cac0958-68e6-5a3b-631a-c7f407794280 optInRequired: 3 timestamp: 1592850392 userID: 36966f73a802b0f3e37b385983f3d21d556b0c9d5e2e4bcd9163526bafe12320 version: 4 visibility: anonymous,support }
app.session.udf.telemetry	Reports information about visualizations and configurations that users implement in beta glass tables.	component: app.session.udf.telemetry data: { [-] app: itsi definition: { [-] inputs: { [-] input1: { [-] options: { [-] items: 3 } titleLength: 6 type: input.dropdown } } layout: { [-] globalInputs: [ [-] input1 ] options: { [-] height: 750 width: 1300 } structure: [ [-] { [-] item: viz_eGQh2uAJ position: { [-] h: 730 w: 1280 x: 10 y: 10 } type: block } { [-] item: viz_2WcVmXz0 position: { [-] h: 450 w: 770 x: 260 y: 20 } type: block ] type: absolute } titleLength: 26 visualizations: { [-] viz_2WcVmXz0: { [-] options: { [-] preserveAspectRatio: true src: true } type: viz.img } viz_5HKW2R1q: { [-] options: { [-] legend.placement: top } titleLength: 29 type: viz.line } } } definitionInfo: { [-] componentCounts: { [-] dataSourceTypeCounts: { [-] ds.test: 11 } inputTypeCounts: { [-] input.dropdown: 1 } vizTypeCounts: { [-] abslayout.line: 6 viz.img: 1 viz.line: 2 viz.rectangle: 1 viz.singlevalue: 8 viz.table: 1 viz.text: 3 } } numDataSources: 11 numInputs: 1 numViz: 22 } page: boston_marathon__absolute__k0wxyjod/edit pageAction: dashboard.initialize udfVersion: 5.2.0 } deploymentID: e5fc210a-8e27-54b6-b50e-306304917a3f eventID: 40c251b1-09ad-cb2d-cb64-c503c8e91695 experienceID: 10fa783d-65c5-0ece-9808-416f92ccfd48 timestamp: 1569281682 userID: 0b9a7eef9855fe028ae96a4eeea30356bdd66dfeeae10002503a6e7dd9be0e92 version: 3 visibility: anonymous,support
app.ITSI.entityLifecycleManagement	Number of entity lifecycle management policies having auto retire feature enabled on the Splunk system.	{ "timestamp":1648091047, "component":"app.ITSI.entityLifecycleManagement", "executionID":"64FB8F4D-5BB9-4D0E-9549-5E5FFFD883C8", "data":{ "countOfRetirableEntities":0, "countOfEntityTypesUnderManagement":3, "countOfDisabledEntityManagementPolicies":9, "countOfEnabledEntityManagementPolicies":1, "countOfEntitiesUnderManagement":2, "countOfRetiredEntities":2, "countOfAutoRetireEntityManagementPolicies":1, "avgPolicyRunTime":4.65, "avgPolicyLookbackPeriod":26 }, "optInRequired":3, "visibility":[ "anonymous", "support" ], "eventID":"0F66ABC6-83C4-4CD2-B762-415D2B2474DD", "type":"aggregate", "deploymentID":"91182b71-8c10-5019-8daa-6722bac9bc27", "app":"itsi" }
app.ITSI.calculationWindowUsage	Information about the types of calculation windows in ITSI.	{ app: itsi component: app.ITSI.calculationWindowUsage data: { customWindow: { calculationWindowValueCount: [ { calculationWindowValue: 33 count: 1 } ] totalCount: 1 } predefinedWindow: { calculationWindowValueCount: [ { calculationWindowValue: 5 count: 8 } ] totalCount: 8 } } deploymentID: a3b9b625-8392-5205-b4e8-350dd0491cbb eventID: 4ECEA390-74EB-48CF-B387-3808D68A7A3B executionID: 110B8DAD-B7F2-4E8B-8CB2-43390A8A253A optInRequired: 3 timestamp: 1665082511 type: aggregate visibility: [ anonymous support ] }
app.ITSI.knowledgeObjectsCounts	Provides a count of various knowledge objects in ITSI.	{ "data":{ "knowledgeObjects":{ "authoredContentPacks": { "totalCount": 1 }, "eventManagementStates":{ "totalCount":6, "privateCount":0, "publicCount":6 }, "glassTables":{ "privateCount":0, "publicCount":2, "totalCount":2 }, "contentPacks":{ "totalCount":1, "DA-ITSI-CP-CUST-63929313c0755967941cb2cd":1 }, "services":{ "kpis":{ "adhocCount":2, "totalCount":1013, "sharedBaseSearchCount":1011, "dataModelCount":0, "metricsCount":0 }, "dependServicesCount":86, "servicesLinkedToATemplate":96, "totalCount":96, "servicesNotInGlobal":2 }, "deepDives":{ "publicCount":1, "privateCount":1, "totalCount":2 }, "correlationSearches":{ "totalCount":7 }, "maintenanceWindows":{ "totalCount":0 }, "homeViews":{ "privateCount":0, "totalCount":11, "publicCount":11 }, "entityManagementRules":{ "totalCount":1 }, "kpiBaseSearches":{ "totalCount":99 }, "entityManagementPolicies":{ "totalCount":0 }, "authoredContentPacks":{ "totalCount":1 }, "entityTypes":{ "totalCount":10 }, "entities":{ "totalCount":2216 }, "kpiTemplates":{ "totalCount":33 }, "notableEventAggregationPolicies":{ "totalCount":6 }, "customThresholdWindows":{ "totalCount":0 }, "kpiThresholdTemplates":{ "totalCount":36 }, "teams":{ "totalCount":5 }, "serviceTemplates":{ "totalCount":10 } } } }
app.ITSI.ATUsage	Provides a count of KPIs with thresholds generated by Splunk AI, and services using adaptive thresholding or using KPIs that have thresholds generated by Splunk AI.	{ "timestamp": 1633320026, "component": "app.ITSI.ATUsage", "executionID": "ECF66CEF-00EC-4EB3-817A-C0CF6A24C24F", "data": { "kpis_using_at": 170, "kpis_using_policies": { "percentage": 4, "stdev": 124, "static": 51, "range": 1, "quantile": 3 }, "kpis_using_threshold_templates": { "kpi_threshold_template_3_stdev": 104, "kpi_threshold_template_3_quantile": 2, "kpi_threshold_template_2_stdev": 2, "kpi_threshold_template_8_stdev": 1 }, "kpis_using_custom_thresholds": 61, "kpis_using_recommendation": 0, "kpis_with_recommendations_modified": 0, "services_using_at": 117, "services_using_custom_thresholds": 16, "services_using_recommendation": 0, "services_with_recommendations_modified": 0, "min_threshold_level": { "percentage": 0, "stdev": -12.18, "range": 0, "quantile": 0 }, "max_threshold_level": { "percentage": 90, "stdev": 12.18, "range": 0.75, "quantile": 0.97 } }, "optInRequired": 3, "visibility": [ "anonymous", "support" ], "eventID": "FAA1804F-F2C5-47A1-B06B-DED1CB31F252", "type": "aggregate", "deploymentID": "91182b71-8c10-5019-8daa-6722bac9bc27", "app": "itsi" }
app.session.ITSI.componentInteraction	Tracks user interactions with various UI elements to understand how users accomplish a specific goal.	{ "optInRequired":3, "visibility":"anonymous,support", "experienceID":"166287aa-3c8d-fdd0-a17f-90aa0fe39596", "version":"4", "timestamp":1691621685, "data":{ "itsiComponent":"ServiceSandbox", "page":"service_sandbox", "action":"Save", "app":"itsi", "numberOfChangesApplied":2 }, "splunkVersion":"9.0.0", "component":"app.session.ITSI.componentInteraction", "eventID":"1f4f5b55-55f7-fb0a-3559-b1cfe78b0734", "deploymentID":"68058ae0-9a56-55f0-bf4b-dd603e22c7aa", "original_timestamp":1691621685, "original_event_id":"76e9282e78b0fc8cec7a2a6358967360d6638f54f4abab8a1770aea10d1d5a3e", "userID":"28586f93ca33c3ae5365473820acf0230abdcb1481e955eea288a99291d81bd4" }
app.ITSI.performanceMetrics	Measures amount of time taken by specific backend functions.	{ app: itsi component: app.ITSI.performanceMetrics data: { averageTime: 0.01605749130249 cumulativeTime: 0.03211498260498 medianTime: 0.01605749130249 method: validate_sandbox numberOfTransactions: 2 p90Time: 0.016411876678467 } deploymentID: e950e291-0ffc-5b55-9435-c43caa398d95 eventID: 78D10842-382A-4A2D-9970-CDE81F738FBE executionID: 15BEDE8E-6FEC-4C3C-9C17-42E18448157D optInRequired: 3 original_event_id: d9407d4db9c3aed0194d5ef4fd5c5bceb28097e5088d154f0f0c29cb713746e5 original_timestamp: 1696363278 timestamp: 1696363278 type: aggregate visibility: [ anonymous support ] }
app.ITSI.entityDiscoverySearchCleanupCommand	Information about when the CleanupEntityDiscoverySearches command is used.	{ app: itsi component: app.ITSI.entityDiscoverySearchCleanupCommand data: { cleaned_entities: 5 end_time_int: 1696343197.1711 has_error: 0 host: ash-vm1 roles_for_current_user: ['admin'] start_time_int: 1696343195.432 tid: db50487861f811eeb32c00505696f8f7 } deploymentID: 7e475054-ba16-51d7-8ea5-c5a7856b6e64 eventID: 585DDA3D-7EDB-4378-B2DA-1DD9DC606E1C executionID: 8C7FFB2E-2FE6-491A-96F2-D15EAD14FCB7 optInRequired: 3 original_event_id: ecfe876186665569e1223b1373f223bcacd22593992bf179ff4a44780f2890e5 original_timestamp: 1696384807 timestamp: 1696384807 type: aggregate visibility: [ anonymous support ] }
app.ITSI.entitybulkimport	Information about the time spent during various stages of bulk entity import, or discovery searches for entities.	4/22/24 5:59:15.832 PM 2024-04-22 17:59:15,832+0000 process:2220655 thread:MainThread INFO [itsi.bulk_import] [contextlib:126] [exit] Finished tid=fa393b6700d111efa71512488dcd2577 method=EntityUpdaterV2._get_existing_entities_v2 start_time=1713808746.1658652 end_time=1713808755.8324 transaction_time=9.666534900665283 owner='None' host = sh-i-04136a07b5e8ddf66.npasoli-16387903.stg.splunkcloud.comsource = /opt/splunk/var/log/splunk/itsi_command_itsi_import_objects.logsourcetype = itsi_internal_log 4/22/24 5:59:06.165 PM 2024-04-22 17:59:06,165+0000 process:2220655 thread:MainThread INFO [itsi.bulk_import] [contextlib:119] [enter] Invoked tid=fa393b6700d111efa71512488dcd2577 method=EntityUpdaterV2._get_existing_entities_v2 start_time=1713808746.1658652 owner='None' host = sh-i-04136a07b5e8ddf66.npasoli-16387903.stg.splunkcloud.comsource = /opt/splunk/var/log/splunk/itsi_command_itsi_import_objects.logsourcetype = itsi_internal_log 4/22/24 5:59:15.702 PM 2024-04-22 17:59:15,702+0000 process:2220655 thread:MainThread INFO [itsi.bulk_import] [contextlib:126] [exit] Finished tid=fa393b6700d111efa71512488dcd2577 method=EntityUpdaterV2._execute_multithreaded_entity_get start_time=1713808746.1802654 end_time=1713808755.7026548 transaction_time=9.52238941192627 owner='None' host = sh-i-04136a07b5e8ddf66.npasoli-16387903.stg.splunkcloud.comsource = /opt/splunk/var/log/splunk/itsi_command_itsi_import_objects.logsourcetype = itsi_internal_log 4/22/24 5:59:06.180 PM 2024-04-22 17:59:06,180+0000 process:2220655 thread:MainThread INFO [itsi.bulk_import] [itoa_bulk_import_entity_updater:578] [_execute_multithreaded_entity_get] tid=fa393b6700d111efa71512488dcd2577 len(batched_workload)=50, no_of_threads=10, args:(), kwargs:{'key_field': 'identifying_name'} host = sh-i-04136a07b5e8ddf66.npasoli-16387903.stg.splunkcloud.comsource = /opt/splunk/var/log/splunk/itsi_command_itsi_import_objects.logsourcetype = itsi_internal_log 4/22/24 3:51:40.475 PM 2024-04-22 15:51:40,475+0000 process:1464786 thread:MainThread INFO [itsi.bulk_import] [contextlib:126] [exit] Finished tid=23f77bb000c011efafa61211fe0f2f67 method=EntityUpdaterV2._get_existing_entities_for_fqdn start_time=1713801087.418286 end_time=1713801100.4757488 transaction_time=13.057462692260742 owner='None' host = sh-i-0bb2cc3d075f721cb.npasoli-16388392.stg.splunkcloud.comsource = /opt/splunk/var/log/splunk/itsi_command_itsi_import_objects.logsourcetype = itsi_internal_log 4/22/24 3:51:27.418 PM 2024-04-22 15:51:27,418+0000 process:1464786 thread:MainThread INFO [itsi.bulk_import] [contextlib:119] [enter] Invoked tid=23f77bb000c011efafa61211fe0f2f67 method=EntityUpdaterV2._get_existing_entities_for_fqdn start_time=1713801087.418286 owner='None' host = sh-i-0bb2cc3d075f721cb.npasoli-16388392.stg.splunkcloud.comsource = /opt/splunk/var/log/splunk/itsi_command_itsi_import_objects.logsourcetype = itsi_internal_log
app.SA-ITSI-DriftDetection	Capture details of the detected drifts, including drift type, length, and segments of accumulated drifts.	{ app: detectdrift component: app.SA-ITSI-DriftDetection data: { asctime: 2024-05-16 13:40:22,254 created: 1715892022.254040 df_length: 277 df_time_span: 275 days 23:00:00 event_type: calling_detect_drifts kpi_id: kpi_id logtype: telemetry name: sa-itsi-driftdetection-telemetry pid: 90210 service_id: service_id threshold: 80 threshold_direction: both } deploymentID: 5bc6da02-eb7d-587f-822d-f8963128734e eventID: 071455E8-75B9-439E-9648-5BA740E1BC49 executionID: 1EB266FC-A7F7-4532-B716-35C9713744A5 optInRequired: 3 original_event_id: 17c3e32b8c0bd5bbfec4aa3657cd0475d242e99326ab6f0b2fe31c61cddc225b original_timestamp: 1715977860 timestamp: 1715977860 type: aggregate visibility: }
app.SA-ITSI-AT-Recommendations	Logs when the pattern detection for a KPI/entity is completed and tracks the efficiency of the KPI workflow.	app: SA-ITSI-AT-Recommendations component: app.SA-ITSI-AT-Recommendations data: { asctime: 2024-05-09 10:45:24,780 count_of_processed_ids: 1 created: 1715276724.780108 entity_key: 130e1f7f-ad8b-4718-9d9b-acef32af244f entity_level_processing: True entity_title: e6e0c4d9830348ec0074eb09d106869103350dde243a25a0fbf1413e861de5d4 event_type: kpis_processing_complete logtype: telemetry name: sa-itsi-at-recommendations-telemetry pid: 98966 processing_time: 23.20849s } deploymentID: 486b83b7-904d-582e-b316-2849a706f4d2 eventID: 7F45040E-CE23-46B1-8DE4-368B052A13CB executionID: C2D316B6-E21F-41C8-A43F-7F4F3F366F5C optInRequired: 3 original_event_id: e7b8d976ba993bbb945b5b6042c45fb271fb739d84be7e51963443fa53608e2b original_timestamp: 1715343811 timestamp: 1715343811 type: aggregate visibility: [ anonymous ] }