Splunk® IT Service Intelligence

Administer Splunk IT Service Intelligence

Download manual as PDF

Download topic as PDF

Import entities from a CSV file in ITSI

Import entities from CSV files that contain one or more entity definitions. Importing entities from CSV files is an efficient way to define multiple entities. You can dump data from a change management database (CMDB) or asset inventory database into a CSV file and automate the import for ongoing updates.

Prerequisite

  • By default, only a user with the itoa_admin role can bulk import entities.
  • To import entities from CSV, you must create a CSV file that contains your entity definitions. Specify column names in the first row. In each subsequent row, specify an entity title, as well as one or more entity aliases, and one or more entity information fields. To associate an entity with a service, provide a column with the name of the service. Import from CSV has a limit of one service and one entity per row. There is no limit on the number of dependent services, entity aliases, or entity rule values per row. A CSV file can contain multiple rows. Import from CSV supports five different separators: comma (,), semicolon (;), pipe (|), tab (\t), and caret (^).

Scenario

In this example we want to create two entities called appserver-04 and appserver-05, and associate appserver-04 with the Web A service and associate appserver-05 with the Web B service. The Web A service already exists in ITSI but the Web B service does not.

Entitiescsv.png

Steps

  1. Click Configure > Entities.
  2. Click Create Entity > Import from CSV.

    If your role does not have write access to Global team, you will not see the New Entity button.

  3. Click browse... and select your CSV file, or drop it into the UI.
    The CSV file uploads and a file preview appears.
    EntitiesPreview.png
  4. Click Next.
  5. Under Import Column As, select the appropriate column type for each column.
    Column type Description
    Entity Title Makes the column entry the entity title. The column is also added as an Entity Alias using <column name> = <value>.
    Entity Description Makes the column entry a description of the entity.
    Entity Alias Makes the column entry a searchable entity identifier.
    Entity Information field Makes the column entry a tag that provides user-facing validation.
    Service Title Makes the column entry the name of the service to associate the entity with. The service will be created if it does not already exist.
    Service Description Makes the column entry the description of the service.
    Do Not Import Removes the column entry from the imported data.

    You can edit the Column Name field for columns that you import as Entity Title, Entity Alias, and Entity Information, for custom field mappings.

    For this example, we map the columns in the CSV file to the following fields in ITSI:
    ColumnEntities .png

  6. Configure the following options in the Settings section:
    Option Description
    Service Team

    (Only displayed if you are importing services.)

    The team to create the services in.
    Import Services As

    (Only displayed if you are importing services.)

    Whether services are enabled or disabled upon import.
    Conflict Resolution Determines how ITSI updates and stores your entity data:
    • Skip Over Existing Entities: Adds new entity data to the datastore only if the entity does not already exist. If an entity already exists, the entity is not updated.
    • Update Existing Entities: Merges the imported data and the existing data associated with the entity. Uses the Conflict Resolution field to identify the entity.
    • Replace Existing Entities: Replaces existing entity data with new entity data. Uses the Conflict Resolution field to identify the entity.
    Conflict Resolution Field The field used to merge on. Entities that have the same field value are considered to be the same entity. For example, if there is an entity defined with the same IP then merge into that entity. If Conflict Resolution is set to Update Existing Entities or Replace Existing Entities, ITSI resolves duplicate entities based on this field.

    For this example, we are using Update Existing Entities and host for the Conflict Resolution field. For more information about Conflict Resolution, see Conflict Resolution examples in ITSI.

  7. In the Preview section, click Entities to be imported to confirm that your entity import configuration is correct.

    The preview shows the entity information you're importing. It doesn't show the final merged entity values.

  8. Click Import.
  9. Click View all Entities and View all Services to confirm that your imported entities and services appear.
    For example, for service Web A (which already existed), an Entity Title matching rule has been added for appserver-04. appserver-04 is listed in the table of matching entities and the aliases and Information fields have been added to the entity from the CSV file.
    WebAEntities.png
    We also see that the service Web B has been created and that an Entity Title matching rule has been added for appserver-05. We see appserver-05 listed in the table of matching entities at the bottom and we see the aliases and information fields have been added to the entity from the CSV file.
    WebBEntities.png
  10. (Optional) Click Set up Recurring Import to create a modular input for the CSV file. For more information, see Set up recurring import of entities in ITSI in this manual.
PREVIOUS
Auto-detect entities using ITSI modules
  NEXT
Import entities from a Splunk search in ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters