Splunk® IT Service Intelligence

Service Insights Manual

Overview of service templates in ITSI

Service templates in IT Service Intelligence (ITSI) help you manage services in bulk. Any changes you make to a template are propagated to all linked services. For example, if you add a KPI to a service template, it is added to all the linked services. You can still configure KPIs and entity rules that are unique to a service directly in the service.

Service templates help you perform the following tasks:

You can also use the ITSI REST API to link services to service templates. It is best practice to create the service on which to base the template in the UI rather than creating the service through the ITSI REST API. See itoa_interface/service/<_key>/base_service_template in the ITSI REST API Manual for information.

You can control how the following updates are propagated to linked services:

Property Options
Entity rules Whether to overwrite the rules in the linked services or not.
KPI threshold templates Whether to update the threshold templates for all KPIs, no KPIs, or only unchanged KPIs in the linked services.
Health score Whether to overwrite the KPI importance values in the linked services with those in the template. This setting doesn't affect any additional or dependent KPI importance values.

How service templates differ from services

Service templates differ from services in the following ways:

  • Templates don't contain a service health score.
  • Template KPIs can only use a base search, not ad hoc or data model searches.
  • Templates don't have service dependencies. You must define dependencies in individual services.
  • Templates allow entity values to be defined in the linked services rather than in the template. These are known as configurable entity rules.
  • You can't enable anomaly detection for KPIs in a template. You must manually enable it for KPIs in individual services.


Service templates exist in the Global team. You must have write access to the Global team and the write_itsi_base_service_template capability to create and manage service templates. By default, only the itoa_admin possesses this capability. For more information, see ITSI capabilities reference in the Administration Manual. Team admins, or users with a role that inherits from the itoa_team_admin role, can create services for their teams using service templates. The same template can be used for services in different teams. Dependent services don't have to be linked to the same service template as the parent service. For more information, see Overview of teams in ITSI.

Performance and scaling

The higher the number of services linked to a service template, the higher the number of KPIs that use the same base search. For example, if a service template has ten KPIs and is linked to twelve services, each KPI base search in the template is being used twelve times, once for each of the linked services.

If the same KPI base search is used by too many services, this can lead to performance issues. For more information, see KPI base search performance considerations.

Next steps

To start, create one or more service templates in your ITSI environment. To do so, you must create a service and then create a service template from it. For instructions, see Create a service template in ITSI.

Last modified on 28 April, 2023
Aggregate versus maximum severity KPI values in ITSI   Create a service template in ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.11.0, 4.11.1, 4.11.2, 4.11.3, 4.11.4, 4.11.5, 4.11.6, 4.12.0 Cloud only, 4.12.1 Cloud only, 4.12.2 Cloud only, 4.13.0, 4.13.1, 4.13.2, 4.13.3, 4.14.0 Cloud only, 4.14.1 Cloud only, 4.14.2 Cloud only, 4.15.0, 4.15.1, 4.15.2, 4.15.3, 4.16.0 Cloud only, 4.17.0, 4.17.1, 4.18.0, 4.18.1, 4.19.0

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters