Splunk® IT Service Intelligence

Administer Splunk IT Service Intelligence

Download manual as PDF

Download topic as PDF

Bulk import services in ITSI

ITSI provides two methods to bulk import service definitions:

Import from CSV
Import service definitions from a CSV file.
Import from search
Import service definitions from Splunk searches.

You can use either bulk import method to do the following:

  • Create multiple services.
  • Add service dependencies.
  • Link services to service templates (and provide entity rule values for configurable service template entity rules).
  • Add associated entities to services.

Do not attempt to import more than a 1,000 services with links to service templates. If you need to import more than 1,000 services and link them to service templates, do the imports in smaller batches. Only import 200-300 services with links to service templates at a time.

Use cases

The rows and columns that your CSV file contains, or the fields that your search contains, depend on your specific use case.

Import new services

Perform the following high-level steps before importing:

  1. Create a CSV file or write a search that contains the services to import.
  2. In the first row of a CSV, specify the column names.
  3. In each subsequent row, specify one service, and, optionally, a service description and one or more service dependencies.

Note that the services created through this method are no populated with KPIs or entities.

Import new services and link them to service templates, or link existing services to service templates

When you link a service to a service template, the service receives the KPIs and entity rules from the template. Note that if a service already exists, ITSI replaces any entity rules in the service with the entity rules in the service template. For more information about service templates, see Create and manage service templates in ITSI.

  1. Review the entity rules for the service templates you want to link services to and determine which entity rules have configurable values. You must provide those values for each service in the CSV or search. For information about entity rules, see Add entity rules to a service in ITSI.
  2. Create a CSV file or write a search that contains the services to import and the corresponding template to link them to.
  3. In the first row of a CSV, specify column names. In each subsequent row, specify one service, and, optionally, a service description, one or more service dependencies, and the name of the service template to link the service to.
  4. Include one or more columns that provide values for the configurable entity rules in the service templates.

Import services with associated entities

Before importing, create a CSV file or write a search that contains the services and entities to import. ITSI creates an entity rule for the service with Entity Title matches <value from Entity Title column> for each entity. See Import ITSI entities from a CSV file for an example.

Import services, link them to service templates, and import entities

In the CSV file, include columns to use as values for any configurable entity rules in the templates. To import entities, use either a separate column or the same column that is used for configurable entity rules. In the latter case, entities are created for the column you import as Entity Title. However, instead of adding entity rules in the format Entity Title matches <value from Entity Title column> to the service, ITSI adds the entity rules from the linked template to the service. Any configurable entity rules use the column(s) you specify as the value for the configurable entity rules.

Import from CSV

You can create new services by importing the contents of a CSV file. The rows and columns that your CSV file contains depends on the use case. This section contains an example of importing services and linking them to service templates.

You can import a maximum of one service and one entity per row. There is no limit on the number of dependent services, entity aliases, entity information fields, or entity rule values per row. Import from CSV supports five different separators: comma (,), semicolon (;), pipe (|), tab (\t), and caret (^).

If a service has multiple dependent services, use multiple columns with different names. For example, Dependent Service 1 and Dependent Service 2. Alternatively, you can include multiple rows containing the same service and separate dependencies. Likewise, multiple rows can contain the same service and separate entities to add to it.

Prerequisites

  • You must be assigned the itoa_admin role or have the write_itsi_service capability to bulk import services.
  • If you plan to link services to service templates, create the service templates first. You cannot create service templates through the bulk import process. For more information, see Create a service template in ITSI.

Steps

  1. Create a CSV file that contains your services.
    In this example, we want to create eight services with various dependencies and link them to two different service templates. Three columns (applicationname, app_title, and host) provide entity rule values for the services.
    ServiceimportCSV.png
    The following image shows what the final service dependency tree will look like:
    ImportCSVTree2.png
  2. After you create your CSV file, click Configure > Services from the ITSI top menu bar.
  3. Click New Service > Import from CSV.
  4. Click browse... and select your CSV file, or drop it into the UI.
    ITSI uploads the CSV file and displays a file preview.
  5. Click Next to see a table populated by the content of your CSV file.
  6. In the Import Column As column, choose how to categorize each column in your file.
    Column type Description
    Service Title Makes the column entry the name of the service.
    Service Description Makes the column entry a description of the service.
    Dependent Services Makes the column entry a dependent service.
    Service Template Link Makes the column entry the service template to link the service to. The service template must already exist in ITSI.
    Do Not Import Removes the column entry from the imported data. Use this setting for columns containing entity rule values if you are linking services to service templates. You will specify the column to use for entity rules later in the import process.

    In this example, we are importing the columns in the CSV file as follows. Note that we are not importing the applicationname, app_title, and host columns. These columns contain entity rule values that are different for each service. You will use them later in the import process.
    ServiceCSVcolumns.png

  7. In the Settings section, configure the following fields:
    Field Description
    Service Team The team that the service belongs to.
    Import Services As Whether services are enabled or disabled upon import. KPI searches do not run if the service is disabled.
    Enable 7 days of backfill for all service KPIs This setting appears if you have selected to import columns as Service Title and Service Template Link. Enabling this setting backfills the KPIs in imported services that are linked to service templates. Enable this setting if you do not have at least seven days of data in the ITSI summary index and you want to use anomaly detection or adaptive thresholding for any of the KPIs in the service template.
  8. See the Preview section to confirm that your service import configuration is correct.
  9. Click Next.
  10. Perform one of the following tasks:
    • If you selected to import a column as a Service Template Link, go to the Define Entity Rules step (Step 11).
    • If you are not linking services to service templates, skip to the Import step (Step 14).
  11. In the Define Entity Rules step, select a service template to complete the template entity rules.

    For the templates that have configurable entity rules, the Entity Rules Complete column displays "Incomplete".

    In this example, the Web Store template has four entity rules. One of them has a value defined in the template: itsi_role matches operating_system_host. Every service linked to this template receives this field/value pair. The other three entity rules have values in the service template of matches a value to be defined in the service. Therefore, you must provide the value for each service in this step using a column from the CSV file.

  12. Click Select a column to provide the entity rule value for each configurable entity rule in the template as shown in the following example:
    Entityrules web store template.png
    In this example, the Web A service receives *Web* for the applicationname value, New_Relic_Buttercup_Web:8675309 for the app_title value and webserver* for the host value.
  13. Preview the entities for each service linked to the template. Note that ITSI can only match existing entities. Any entities being imported do not appear in the preview.
  14. Click Import. A message confirms that the import is complete.
  15. Click View All Services to confirm that your imported services appear on the Service page. If you linked services to templates, the Service Template column indicates that it's synced with the service template. The template populates the KPIs and entity rules for the services. Any configurable entity rules that came from the template contain the value from the column you specified during the import process.
  16. (Optional) Click Set up Recurring Import to create a modular input for the CSV file.

Import from search

You can import multiple services from ITSI module searches, saved searches, and ad hoc searches. The Import from Search workflow is identical to the import from CSV workflow, except that you specify a search string instead of uploading a CSV file.

The example in this section shows you how to import services and entities and associate the entities with the services. For an example of importing services and linking them to service templates, see the Import from CSV section.

Prerequisites

  • You must be assigned the itoa_admin role to bulk import services.
  • If you are linking services to service templates, create the service templates first. You cannot create service templates through the bulk import process. They must already exist in ITSI. For more information, see Create service templates in ITSI.

Steps

  1. Click Configure > Services from the ITSI top menu bar.
  2. Click New Service > Import from search.
  3. Select one of the following search types:
    Search Type Description
    Modules Choose from a list of pre-defined entity discovery searches based on ITSI modules.
    Saved Search Choose from a list of pre-defined ITSI saved searches.
    Ad hoc Search Enter a custom search string.
  4. Enter an ad hoc search string or select a predefined module search or saved search. Make sure the results are presented in a table.
    For this example we are using an ad hoc search to import services and entities.
  5. Click the Search icon.
    The specified search runs and a Search Results Preview appears.
    We want to create two services called Splunk Search Head Service and Splunk Indexer Service (using the service_title column) and create three entities for the hosts listed in the host column and add these entities to the services. EntityImportSearch.png
  6. Click Next.
    The Select Columns page appears, showing a table populated by your search results. Use this page to specify how to classify and store the file column entries that define your entities.
  7. For our example, we are importing the columns in our search results as follows. ImportSpecifyColumns.png
  8. In the Settings section, configure the following items:
    Field Description
    Service Team The team that the service belongs to. Entities are always created in the Global team.
    Import Services As Whether services are enabled or disabled upon upgrade.
    Conflict Resolution Determines how ITSI updates and stores your entity data:
    • Skip Over Existing Entities: Adds new entity data to the datastore only if the entity does not already exist. If an entity exists, the information is not updated.
    • Update Existing Entities: Merges the imported data and the existing data associated with the entity.
    • Replace Existing Entities: Replaces existing entity data with new entity data.
    Conflict Resolution Field The field used to identify entities. Entities that have the same field value are considered the same entity. If Conflict Resolution is set to Update Existing Entities or Replace Existing Entities, ITSI resolves duplicate entities based on this field.

    For more information about Conflict Resolution, see Conflict Resolution examples in ITSI.

  9. In the Preview section, click Services to be imported to confirm that your service import configuration is correct.
    BulkImportPreview.png
  10. Click Import.
    A message confirms that the import is complete.
  11. Click View All Services or View all Entities to confirm that your imported services and entities now appear on the respective Service or Entity page.
  12. (Optional) Click Set up Recurring Import to create a modular input that runs import search on a recurring basis.
PREVIOUS
Clone a service in ITSI
  NEXT
How service health scores work in ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1, 4.4.0


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters