Create a single ITSI service using an SAI service template

Create a single service in ITSI from Splunk App for Infrastructure entities using an SAI service template.

When creating an ITSI service using an SAI service template:

• SAI service templates populate the service with default KPIs and partial entity rules. See SAI service templates.
• KPI thresholds are configured by default.
• You can view the health of the service on the Service Analyzer.
• Integration is one direction only, from the Splunk App for Infrastructure to ITSI.

Prerequisites

• Integration between the Splunk App for Infrastructure and ITSI must be enabled. See Integrate with the Splunk App for Infrastructure.
• SAI entities must be ingested into ITSI. See Integrate entities from the Splunk App for Infrastructure with ITSI.
• You must have the admin_all_objects capability to enable and manage the integration. The admin role has this capability by default.

Steps

Perform the following steps to create an ITSI service from SAI entities.

Create the service

1. Open Splunk IT Service Intelligence.
2. Click Configure > Service Templates.
3. Open the SAI service template you want to use to create the service. For information about the available SAI templates, see Overview of creating an ITSI service using an SAI service template.
4. Click New Service From Template.
5. Perform the following steps in the Create Service dialog:
   1. Provide a title and description for the service. For example, name the new ITSI service the same name as the group you are importing from SAI. Consider adding SAI to the service title to easily locate and filter the service on the Services lister page.
   2. Global team is selected by default. If no private teams have been created for your organization, the only team available is Global and this is where you will create all services.
   3. Link service to a service template is selected by default. This setting populates the service with partial entity rules and KPIs from the service template.
   4. Link to template displays the pre-defined service template selected.
   5. Review the entity rules and KPIs in the template. These are added to the new service.
   6. (Optional) Select Enable 7 days of backfill for all service KPIs if you need to populate the summary index with data in order to use adaptive thresholding or anomaly detection with any of your KPIs. This setting applies to all the KPIs in the service. Individual KPIs cannot be selected for backfill. Note that you cannot enable backfill for a KPI that came from the template in the service at a later time as this action will unlink the service from the template.
6. Click Create.

Configure the service

1. On the Entities tab, edit the entity rules according to the requirements of the template you are using.
   Match the entity rules for the ITSI service with the SAI group dimensions. The entity rules act as the filters to match the entities to your service. See Entity rules for SAI service templates when creating ITSI services.
2. Click the KPIs tab. Default KPIs are applied to the service. KPI threshold values are configured by default.
   If you change any of the KPI threshold value settings, the thresholds are no longer synced with the service template KPIs, even though the service is still linked to the template. See Set aggregate threshold values.
3. (Optional) Apply anomaly detection to the KPIs. See Apply anomaly detection to a KPI in ITSI.
4. Click Save.

View the health of your service

1. View the newly created service on the Services lister page.
2. After about five minutes, the service appears on the Service Analyzer. Use the Service Analyzer to monitor the health of the service.

Investigate service issues in a deep dive

Deep dives are an investigative tool to help you identify and analyze issues in your IT environment. If your service's health begins to decline, open it in a deep dive to perform root cause analysis.

1. Click the check mark in the top right corner of the service that is experiencing problems.
   
2. Click Drilldown to Deep Dive. The service's health score and KPIs appear as swim lanes.
3. To view the individual SAI entities, click the gear icon in any KPI lane and select Lane Overlay Options, then click Yes to enable entity overlays. For more information, see Add overlays to a deep dive in ITSI.
4. (Optional) Click anywhere in the swim lane and select Add Overlay as Lane to add the entities as individual lanes.
5. (Optional) Click anywhere in an entity lane and select Splunk App for Infrastructure to open the Entity Overview in SAI. For more information, see Using the Entity Overview in Splunk App for Infrastructure.

See also

• Overview of creating an ITSI service using an SAI service template
• Key ITSI concepts in the Splunk IT Service Intelligence Administer Splunk IT Service Intelligence manual.