Splunk® IT Service Intelligence

Administer Splunk IT Service Intelligence

Download manual as PDF

Download topic as PDF

Update a service template in ITSI

Make updates to a service template to update all the services linked to the template. You can choose to push updates to the linked services immediately or schedule a specific date and time to push the updates.

  1. Click Configure > Service Templates.
  2. Open a service template.
  3. On the Entities tab, add, modify, or delete entity rules as desired.
    Use the matches a value to be defined in the service or does not match a value to be defined in the service options to specify the value for an entity rule in each service rather than in the template. This is useful if each service linked to the template will be monitoring different entities. For example, you could specify Alias vm_name matches a value defined in the service. Then, after the services have been synced with the template, specify the value for vm_name in each service. These options are particularly useful if you plan to bulk import services and link them to the template.

    If you use the configurable entity rules described above and choose to Overwrite Entity Rules when you save the service template, any entity rules already defined in the linked services will be replaced with the entity rules from the template and they will have blank values (matching all entities).

  4. On the KPI tab, add, modify, or delete the KPIs in the template, and set KPI thresholds as desired. Any KPIs you add to the template must use a base search. Template KPIs cannot use ad hoc, metrics, or data model searches.

    You cannot enable anomaly detection in a service template. You must enable anomaly detection for a KPI in the service directly.

  5. On the Settings tab, set importance values for the KPIs and see how they affect the health score of linked services.
  6. When you finish making modifications to the service template, click Save.
  7. In the Save Service Template dialog box, indicate what information to update and select when to push the changes to the linked services.
    Setting Description
    Overwrite entity rules Replaces the entity rules in the linked services with the entity rules in the template.
    Overwrite KPI thresholds and alerting rules on Whether to update KPI thresholds and KPI alerting rules.
    • Select All Unchanged KPIs if you customized some of the KPI thresholds or alerting rules in your services and you want to keep these settings.
    • Select All KPIs to overwrite customized thresholds and alerting rules in linked services.

    This setting does not affect KPI thresholds or alerting rules for any KPIs that are unique to the service and not linked to the template.

    Overwrite health score calculation Replaces the KPI importance values used to calculate the health score in the linked services with the values from the template. KPI importance values for any additional KPIs in the service that are not present in the template are not affected. Importance values for dependent services are also not affected.
    Push changes to services When to push the changes to the linked services. Either push the changes immediately, or select Later to choose a date and time to update the linked services. It is considered a best practice to push changes outside of regular business hours to avoid disruption.
  8. Click Save. The changes in the template are immediately propagated to the linked services if you chose to push the changes now, or scheduled for the date and time you selected.
  9. Click the Linked Services tab to see the sync status of the services linked to the template.

After the linked services are synced with the template, the status says "Synced". If you elected to push the changes now, you might need to refresh your browser to see the status change. You will also receive a message in Splunk Web with the status of the sync.

You can only schedule one sync for a service template. If you make additional updates to a service template that is already scheduled, you can keep the scheduled time (the default) or choose to sync now or at a different time. All updates that have been made to the template are pushed at the time you choose.

Create a service template in ITSI
Link a service to a service template in ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters