Splunk® IT Service Intelligence

Service Insights Manual

Add tags to a service in ITSI

Add tags to a service in IT Service Intelligence (ITSI) to provide more context when filtering your services and remediating issues. You can leverage the search bar in the Service Analyzer to filter to a specific subset of services based on the tags those services contain, in addition to the service name and KPI name.

Service tags can serve a variety of functions, including the following examples:

  • They eliminate the need to append prefixes to your service titles because you can perform the same filtering actions directly through tagging.
  • You can tag services with their team name (TeamA, TeamB, and so on) and use it to filter by teams in the Service Analyzer.
  • They provide a second layer of filtering in the Service Analyzer beyond services and KPIs. For example, after filtering to your Web Store services, you could include an additional filter for the tag AMEA to only view web store services in that specific region.

Consider the following rules for adding tags:

  • You can't add duplicate tags to a service.
  • Tags are case insensitive, meaning you can't add duplicate tags of different cases.
  • Tags must be strings and can't contain the following characters: / \ " ' ! @ ? . , ; $ ^


You must have write access to a service to add tags to it. For more information, see ITSI capabilities reference in the Administration Manual.


Perform the following steps to add tags to a service:

  1. From the ITSI main menu, select Configuration then Service Monitoring then Service and KPI Management.
  2. Open the service you want to add tags to.
  3. Go to the Settings tab.
  4. Under Tags, add one or more tags to the service. Tags with a lock icon indicate they came from a service template.
  5. Select Save.

After tagging the services in your environment, go to the Service Analyzer and use the Filter by Tags option to filter on different tags and view the corresponding services and their KPIs. For more information, see Overview of the Service Analyzer in ITSI.

Tags within service templates

When you add tags to a service template, those tags are appended to the existing tags in all linked services when the next template sync happens. Template tags have a lock symbol to indicate they were populated from a template:


If you add or remove tags from a template, they're also added or removed from the linked services. Tags act as soft links between services and templates, so removing or adding a tag to a linked service doesn't unlink it from its template. For a list of actions that do unlink a service from a template, see Link and unlink a service from a service template in ITSI.

Duplicate tags aren't allowed. Therefore, when tags are propagated from a template to its linked service, the tags are deduplicated in favor of those from the template.

When you create a new service template from an existing service, all tags from the service are included in the template. For more information, see Create a service template in ITSI. However, If you create a new service template from a service that's already linked to an existing template, the new template only receives the manually-added tags and not those from the existing template.

If you relink a service from template A to template B, the manually-added service tags are retained, whereas the linked tags from A are replaced with those from B. For more information, see Link a service from one template to another.

Last modified on 29 April, 2024
Backfill service health scores in ITSI   Scenario: Kai monitors business service degradation and identifies the root cause

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.19.0

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters