Splunk® IT Service Intelligence

Administration Manual

Download manual as PDF

This documentation does not apply to the most recent version of ITSI. Click here for the latest version.
Download topic as PDF

Manage services in bulk with service templates in ITSI

Service templates in IT Service Intelligence (ITSI) help you manage services in bulk. Any changes you make to a template are propagated to all linked services. For example, if you add a KPI to a service template, it is added to all the linked services. You can still configure KPIs and entity rules that are unique to a service directly in the service.

Service templates help you perform the following tasks:

You can also use the ITSI REST API to link services to service templates. It is best practice to create the service on which to base the template in the UI rather than creating the service through the ITSI REST API. See itoa_interface/service/<_key>/base_service_template in the ITSI REST API Manual for information.

You can control how the following updates are propagated to linked services:

Property Options
Entity rules Whether to overwrite the rules in the linked services or not.
KPI threshold templates Whether to update the threshold templates for all KPIs, no KPIs, or only unchanged KPIs in the linked services.
Health score Whether to overwrite the KPI importance values in the linked services with those in the template. This setting doesn't affect any additional or dependent KPI importance values.

How service templates differ from services

Service templates differ from services in the following ways:

  • Templates don't contain a service health score.
  • Template KPIs can only use a base search, not ad hoc or data model searches.
  • Templates don't have service dependencies. You must define dependencies in individual services.
  • Templates allow entity values to be defined in the linked services rather than in the template. These are known as configurable entity rules.
  • You can't enable anomaly detection for KPIs in a template. You must manually enable it for KPIs in individual services.

Permissions

Service templates exist in the Global team. You must have write access to the Global team and the write_itsi_base_service_template capability to create and manage service templates. By default, only the itoa_admin possesses this capability. For more information, see ITSI capabilities reference in the Install and Upgrade Splunk IT Service Intelligence manual.

Team admins, or users with a role that inherits from the itoa_team_admin role, can create services for their teams using service templates. The same template can be used for services in different teams. Dependent services don't have to be linked to the same service template as the parent service. For more information, see Overview of teams in ITSI.

Performance and scaling

The higher the number of services linked to a service template, the higher the number of KPIs that use the same base search. For example, if a service template has ten KPIs and is linked to twelve services, each KPI base search in the template is being used twelve times, once for each of the linked services.

If the same KPI base search is used by too many services, this can lead to performance issues. For more information, see KPI base search performance considerations.

See Also

Last modified on 10 June, 2020
PREVIOUS
Synchronize KPI searches in ITSI
  NEXT
Create a service template in ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.1.0, 4.1.1, 4.1.2, 4.1.5, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1, 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters