Splunk® IT Service Intelligence

Administer Splunk IT Service Intelligence

Download manual as PDF

Download topic as PDF

Conflict resolution examples in ITSI

When you import entities from CSV or search, you must select a conflict resolution type and a conflict resolution field. The conflict resolution field is the field you'd like to use to identify entities. Entities that have the same value for the conflict resolution field are considered to be the same entity. The conflict resolution type determines how ITSI updates and stores your entity data. The following examples demonstrate the behavior of each conflict resolution type.

Skip Over Existing Entities

Adds new entity data to the datastore only if the entity does not already exist. If an entity exists, the information is not updated.

For example, if you import the following CSV file and you use title as the Conflict Resolution field, if Server_1 and Server_2 already exist as entities, they will not be updated with the imported data. If no entities already exist with a title of Server_1 or Server_2, these entities will be created from the imported data.

title, IP, host
Server_1, 192.168.1.1, somehostName
Server_2, 192.168.2.2, anotherhostName

Update Existing Entities

Merges alias and information fields of imported entities with existing entities. Entities that have the same value in the Conflict Resolution field are treated as the same entity.

  • Each entity that matches the Conflict Resolution field value receives the merged field values.
  • If the Conflict Resolution field doesn't exist in the existing entity, the existing entity isn't affected.
  • If the Conflict Resolution field doesn't exist in the CSV or search data, the row data isn't imported.
  • If the Conflict Resolution field is an Alias, but in the existing entity the field is an Info field, the existing Info field is preserved.
  • If the Conflict Resolution field is an info field, but in the existing entity the field is an Alias, the existing Alias field is preserved.

In this example, the entities in the first example have been created and now you import the following updated entity information using title as the Conflict Resolution field:

title, IP, host
Server_1, 192.168.1.1, somehostName
Server_2, 192.168.2.3, anotherhostName

Server_2 will now have two IP addresses, 192.168.2.2 and 192.168.2.3, while no new data is added to Server_1.

Replace Existing Entities

Replaces existing entity data with new entity data. Entities that have the same value in the Conflict Resolution field are treated as the same entity. For example, if you now import this entity information using title as the Conflict Resolution field:

title, IP, host
Server_1, 192.168.1.2, somehostName2
Server_2, 192.168.2.2, anotherhostName2

The Server_1 and Server_2 entities, which already exist, are replaced with the new entity definitions for Server_1 and Server_2 in the import. The old Alias and Info fields for the entities are replaced with the ones in the import so Server_1 will now have an IP of 192.168.1.2 and a host of somehostName2 and Server_2 will now have an IP of 192.168.2.2 and a host of anotherhostName2.

Example of using a Conflict Resolution field other than Entity Title with Update Existing Entities option

For example, let's say you have two hosts with the same name in different data centers. You import the following columns:

Entity Title (Name) Information Field
host=A datacenter=A
host=A datacenter=B

If you use the host column (Entity Title) as the Conflict Resolution field, and use the Update Existing Entities option, one entity is created because both entities have the same value for host. This means they are treated as the same entity. After importing, entity A will contain both A and B values for datacenter as shown below.

Entity Title (Name) Alias Information Field
A host=A datacenter=A,B

If instead you use the datacenter column (Entity Information Field) as the Conflict Resolution field with the Update Existing Entities option, two entities will be created: the first entity A will be created with an Information field of datacenter=A and a second entity A will be created with datacenter=B as shown below.

Entity Title (Name) Alias Information Field
A host=A datacenter=A
A host=A datacenter=B
PREVIOUS
Set up a recurring import of entities in ITSI
  NEXT
Bulk delete entities in ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1, 4.4.0, 4.4.1


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters