Splunk® IT Service Intelligence

Administer Splunk IT Service Intelligence

Download manual as PDF

Download topic as PDF

Link a service to a service template in ITSI

You can link multiple services to a service template in order to manage them collectively. A service can be linked to only one service template.

When linking a service to a service template, any existing KPIs in the service are preserved and KPIs in the template are added to the service. You can choose how to update the entity rules in a service: append the template entity rules to the service entity rules, replace the service entity rules with the template entity rules, or keep the entity rules in the service and not import any of the entity rules from the service template.

There is no limit to the number of services that can be linked to a service template. However, the higher the number of services linked to a service template, the longer it will take to sync service template updates with the linked services.

This procedure describes how to link a single service to a service template. To link multiple services to a service template, use the bulk import feature. See Bulk import services in ITSI.

To create a new service from a service template, see Create a single service in ITSI.


  • You must have the write_itsi_service capability to link a service to a service template. The itoa_admin and itoa_team_admin roles have this capability by default.
  • At least one service template must exist in ITSI.


  1. Click Configure > Services from the top menu bar.
  2. In the Actions column for the service you want to link, click Edit > Link to Service Template.
  3. Click Select... and choose a template. If the service is already linked to a template, choose a different template to link the service to.
  4. In the template details section, review the entity rules, the KPIs that are contained in the template, and the services already linked to the template.

    When linking a service to a template for the first time, any KPIs that already exist are retained and new KPIs from the template are added. If any KPIs in the service have the same name as a KPI in the template, the KPI in the service is renamed using a unique identifier.

    If the service was already linked to a template and you are linking it to a different template, linked KPIs (those that came from the original template) are removed, unlinked KPIs (KPIs that were added directly to the service) are retained, and KPIs from the newly selected template are added.

  5. In the Settings section, choose how to update the entity rules in the service:
    Setting Description
    Append template rules Adds the entity rules from the template to the service and keeps the ones that were already there.
    Replace with template rule Deletes the existing entity rules in the service and replaces them with the entity rules from the service template.
    Keep existing service rules Keeps the existing entity rules in the service and does not add any entity rules from the template.
  6. Click Link. The Service Template column indicates that the service is synced with the service template.

To review the content updates that the service received from the template, click the name of the service. See Review updates received from the template and customize the service for more information.

Update a service template in ITSI
Manage service templates in ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.1.0, 4.1.1, 4.1.2, 4.1.5, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1, 4.4.0, 4.4.1, 4.4.2

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters