Splunk® IT Service Intelligence

Service Insights Manual

Use the service sandbox in ITSI

Quickly set up your IT environment, onboard services, and map service dependencies using the ITSI service sandbox. The sandbox environment lets you build and test services and their dependencies to reduce the risk of impacts to the production environment, and help you get started with service health monitoring in ITSI.

Interconnected service nodes displayed on a the service sandbox main page and a panel displaying a list of the service dependencies.


  • You must be an itoa_admin or itoa_team_admin to create a service sandbox. Only itoa_admins can publish services from the sandbox.
  • Only itoa_admins can delete a service sandbox.
  • You can only create a service in a team for which you have read and write permissions.
  • The Default Service Sandbox is an out-of-the-box sandbox available for service creation and publishing. You can't update the title or description for this default sandbox.

Note: Changing or deleting the associated team for a sandbox can change service dependencies. Before you can delete a team linked to one or more service sandboxes, you need to select a new team for the services.

Create a new service sandbox and services

Create a new sandbox by selecting Configuration, then Service Monitoring, then Service Sandbox. Select the Create service sandbox button to start building a new sandbox. You have three options to create and populate services in the service sandbox:

  • Create from a service template: Start with a service template to create a full service model, and populate services with KPIs and entities. Services linked to a template are automatically populated with entity rules and KPIs, and you can add additional entity rules and KPIs.
  • Create a new service: Create services one at a time. Map a basic model of services that don't include entity rules and KPIs.
  • Import services from a CSV file: Import from an existing CSV that maps out relationships between services. When importing services using CSV, services not associated with a service template aren't populated with KPIs or entity rules. Import services associated with a service template to create a service topology, with services that are populated with KPIs and entity rules. For more information about importing services from a CSV file, see Import services from a CSV file in ITSI.

Note: You can import up to a maximum of 250 services. If you try to import more than this limit, the import fails.

After selecting how you want to create a service, populate the service with a title and description, as well as select the team to associate the service with. This service will only be visible for roles that are assigned read permission to this team. If no private teams exist for your organization, the service is associated with the Global team. You can view how many services in a sandbox are associated with a particular team on the Teams page in ITSI.

Note: You can only create up to 20 service sandboxes.

Add and remove service dependencies

After you create a service, link it to other services that may impact or influence the first service. For example, you can add your Banking App service as a dependency of the Custom Banking service, because a specific KPI tracked by the Banking App service affects the overall health score for the Custom Banking Service.

  1. Hover over the node for the new service you created on the sandbox canvas. Hold down the small plus (+) sign and drag the node toward another node to create a dependency between services. Alternatively, select the Add dependencies button on the Service dependencies tab.
  2. On the Service dependencies tab in the service panel, select the KPIs from the dependent service that you want to monitor. These KPIs will contribute to the primary service's health score. For example, if the Custom Banking service is a dependent service for the Banking App service, the KPIs you select from the Custom Banking service will contribute to the overall health score of the Banking App.
  3. (Optional) To remove a nested service as a dependency, select the services that you want to remove from the Service dependencies tab, and select the Remove Dependencies button.

Simulate service health scores

Understand the impact and relationships between your service dependencies in a service tree by simulating service health scores. For example, simulate what occurs to a dependent service when its parent service has KPIs with Critical severities.

  1. Turn on simulated health scores from the Simulate Health Score dropdown button. Adding dependencies, changing health scores, and other actions will also affect the health score when this setting is turned on.
  2. Select a service node linked to other dependent services.
  3. From the Simulated Health Score tab, update the simulated severity scores and importance values for each of the service KPIs. You can then visualize the impact of these changes to the health scores of your services in the service sandbox.

View entity filter rules

  1. If you create a service using a service template, then you can select the Entities tab to view entity filtering rules for that service.
  2. (Optional) Open the service definition page to make changes to the entity rules.

Publish services from the sandbox

  1. After you finish creating your services and adding dependencies, select Publish.
  2. A pre-check job will run in order to validate that there are no issues and/or conflicts between your service sand other ITSI knowledge objects. You can navigate away from the page while the pre-check runs and return to the page later in order to view the status.
  3. Any issues identified will be displayed in a list, and critical issues will need to be resolved before you can publish your services. See Troubleshoot issues identified by pre-checks.
  4. After your services successfully publish, view your services in the ITSI Service Analyzer.
  5. (Optional) Select Revert to revert all unsaved changes to your sandbox. Alternatively, select Reset to clear all changes and start over with a new sandbox. See Revert or reset the service sandbox in ITSI.
  6. (Optional) Select Save as draft to save the services and dependencies you created before publishing to production. Selecting this will also run validation pre-checks, but will not save your services to production until you select Publish.

Troubleshoot issues identified by pre-checks

Cause: Conflicting titles

One or more services have duplicate names. The nodes for the duplicates services will be highlighted red.


Change the name of the duplicate services.

  1. Select Configuration then Service and KPI Management.
  2. Filter for the service with the duplicate name and edit the title of the service.
  3. Select Save.

Cause: KPI key not unique

One or more of the dependent KPIs should not be associated with the service.


  1. From the service sandbox, select the service node.
  2. From the Service Dependencies tab in the service panel, select the checkbox for the KPIs that need to be removed.
  3. Select Remove Dependencies.
Last modified on 07 June, 2024
Scenario: Kai monitors business service degradation and identifies the root cause   Revert or reset the service sandbox in ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.19.0

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters