Splunk® IT Service Intelligence

Service Insights Manual

Create a service from a service template in ITSI

After you create a service from a service template in IT Service Intelligence (ITSI), any changes you make to a template are propagated to the service. Entity rules, KPIs, KPI threshold values, and KPI importance values are populated from the template.

If you clone a service linked to a template, the clone is alo linked to the service template.


  • You must create a service template and link at least one service to it. For more information, see Create a service template in ITSI.
  • You must be assigned the write_itsi_service capability to configure services. The itoa_admin and itoa_team_admin have these capabilities by default.


  1. From the ITSI main menu, click Configuration > Service Templates.
  2. Select the service template.
  3. Click New Service From Template.
  4. Provide a title and optional description.
  5. Make sure Link service to a service template is selected.
  6. Click Create. The service receives the entity rules, KPIs, KPI thresholds, and KPI importance values from the template.

Configure the new service

Review and configure the content received from the template.

Review and modify entity rules

Any entity rules without values that came from the template contain a Blank entity value.png icon. Provide a value to filter the service to a specific set of entities. These entity rule values are meant to be custom for each service. Some entity rules might have blank values intentionally and don't display the notification icon.

Add or change entity rules as desired for the service. For more information, see Add entity rules to a service in ITSI. You can choose to preserve any custom entity rules you define in the service when you update the service template.

Review and modify KPIs

KPIs that were added to the service display a lock icon Lock.png to indicate that they're linked to the template. You can set custom thresholds for all linked KPIs without unlinking the service. Making any other changes to a linked KPI, such as deleting it or changing its name, unlinks the service from the template.

You can also manually add KPIs that are specific to this service. For more information about creating KPIs, see Overview of creating KPIs in ITSI. These KPIs aren't overwritten when you update the service template. KPIs added directly to the service don't have a lock icon and aren't tied to the service template.

Specify service dependencies

On the Service Dependencies tab, add other services as impacting services, or service dependencies. Dependencies are not included in service templates so you must configure them manually for each service. For more information, see Add service dependencies in ITSI.

Set KPI importance values

On the Settings tab, change the team the service belongs to or configure KPI importance values. You can preserve custom KPI importance values for a service, which determine the service health score, when you update the service template. For more information, see Set KPI importance values in ITSI.

Add or remove tags

On the Settings tab, add or remove service tags. Tags act as soft links between services and templates, so removing or adding a tag to a service doesn't unlink it from its template. For more information, see Tags within service templates.

Any changes you make to the service apply to the service only. Edit the service template if you want to make changes that propagate to all services linked to the template.

See also

The next time you update the template, any changes you make are propagated to all linked services. For more information about updating a service template, see Update a service template in ITSI.

Last modified on 28 April, 2023
Create a service template in ITSI   Link and unlink services from service templates in ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.11.0, 4.11.1, 4.11.2, 4.11.3, 4.11.4, 4.11.5, 4.11.6, 4.12.0 Cloud only, 4.12.1 Cloud only, 4.12.2 Cloud only, 4.13.0, 4.13.1, 4.13.2, 4.13.3, 4.14.0 Cloud only, 4.14.1 Cloud only, 4.14.2 Cloud only, 4.15.0, 4.15.1, 4.15.2, 4.15.3, 4.16.0 Cloud only, 4.17.0, 4.17.1, 4.18.0, 4.18.1, 4.19.0

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters