Splunk® IT Service Intelligence

Administer Splunk IT Service Intelligence

Download manual as PDF

Download topic as PDF

Manage service templates in ITSI

Service templates let you update services in bulk. To manage service templates, ITSI administrators can perform these tasks:

  • Review content updates received from the template
  • Unlink a service from a service template
  • Clone a service template
  • Delete a service template

Review updates received from a template and customize the service

After linking a service to a template, or changing the template a service is linked to, review the content updates the service received from the template. You can also customize the service to meet your needs. If the service template contains entity rules with values that need to be specified in the service, provide them in the service entity rules.

Review the following tabs within the linked service:


    • Make sure the KPIs from the template were added to the service. These KPIs display a lock icon Lock.png to indicate that they are linked to the template.
    • Set custom threshold settings and enable anomaly detection for linked KPIs as desired. If you change the threshold settings, or if the adaptive thresholding value is recalculated, a Unlockicon.png icon appears in the Thresholding section to indicate the KPI threshold settings differ from those in the service template, but the service is still linked. To preserve custom thresholds in the service, make sure to select Overwrite KPI Thresholds on: All Unchanged KPIs when saving the template and pushing updates to the services.

      Making any other changes to a linked KPI, such as changing the name of the KPI, changing the base search it uses, or enabling backfill, will cause the service to be unlinked from the template.

    • KPIs that already existed in the service are listed without a lock icon. Any changes you make to the service template will not affect them.
    • Any existing KPIs in the service that had the same name as a KPI in the template are renamed with _custom and a unique identifier appended to the name of the KPI. For example, if both the service and the template have a KPI called CPU Utilization: %, the KPI in the service is renamed to CPU Utilization: %_custom_02f8cab3-e5d1-11e7-b55a-005056923ff0 and the CPU Utilization: % KPI from the template is added. You can delete the duplicate KPI if desired.
    • Add any new KPIs to the service as desired. These KPIs will not be overwritten when the service template is updated.


    • If you selected Append template rules when you linked the service to the template, any entity rules that existed in the service are retained and the entity rules from the template are added to a new rule block (with an implicit OR between the rule blocks).
    • If you selected Replace with template rules when you linked the service to the template, any entity rules that were in the service are gone and the entity rules from the service template are added.
    • If you selected Keep existing service rules when you linked the service to the template, the existing entity rules in the service are listed and no new entity rules are added from the template.

Any entity rules with blank values that came from the template contain a Blank entity value.png icon. Provide a value in order to filter the service to a specific set of entities. These entity rule values are meant to be custom for each service. Some entity rules might have blank values intentionally. These do not display the icon.

Add or change entity rules as desired for the service. You can choose to preserve the entity rules in the service when you update the service template.

Service Dependencies

Specify any service dependencies. Service dependencies, or impacting services, have some sort of effect or influence on the primary service. Adding service dependencies can help you detect if one service is having a negative impact on another service, and can be useful in performing root cause analysis.


Enable or disable the service, change the team the service belongs to, and change KPI importance values. Custom KPI importance values for a service, which are used to determine the service health score, can be preserved when the service template is updated.

Unlink a service from a service template

There is no direct method to unlink a service from a template. Once a service is linked to a service template, it can only be unlinked from the template by doing one of the following:

  • Deleting the service template
  • Linking the service to a different service template
  • Modifying the name of a linked KPI
  • Modifying the base search of a linked KPI (or modifying any other settings in the Search and Calculate section, including enabling backfill)
  • Deleting a linked KPI

Linked KPIs have a lock icon next to the name of the KPI in the KPI tab of the service definition.

You can link a service to a different service template from the Linked Services tab of the service template by selecting Link to another Service Template.

To enable backfill for a linked KPI in a service, you must delete the service, recreate it using the service template, and enable backfill for all KPIs in the Settings section of the Create Service dialog box.

Clone or delete a service template

Cloning a service template creates an exact copy of it. However, the cloned template is not linked to the services that are linked to the original service template. Deleting a service template unlinks it from all of its linked services. You can choose to leave them unlinked or link them to another service template.

  1. From the IT Service Intelligence main menu, click Configure > Service Templates.
  2. In the Actions column of the service, click Edit > Clone/Delete.

To delete templates in bulk, select all the templates you want to delete and click Bulk Action > Delete.

Link a service to a service template in ITSI
Predict and prevent outages with ITSI Predictive Analytics

This documentation applies to the following versions of Splunk® IT Service Intelligence: 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.1.0, 4.1.1, 4.1.2, 4.1.5, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1, 4.4.0, 4.4.1, 4.4.2

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters