Splunk® IT Service Intelligence

Administer Splunk IT Service Intelligence

Download manual as PDF

Download topic as PDF

Manage services in bulk with service templates in ITSI

Service templates in IT Service Intelligence (ITSI) help you manage services in bulk. Any changes you make to a template are propagated to all linked services. For example, if you add a KPI to a service template, it is added to all the linked services. You can still configure KPIs and entity rules that are unique to a service directly in the service.

Use service templates to do the following:

You can also use the ITSI REST API to link services to service templates. It is best practice to create the service on which to base the template in the UI rather than creating the service through the ITSI REST API. See itoa_interface/service/<_key>/base_service_template in the ITSI REST API Manual for information.

When you update a template, the following changes are propagated to the linked services:

    • New KPIs
    • Deleted KPIs

For the following properties, you can control how the updates are propagated to linked services:

Property Options
Entity rules Choose whether to overwrite the rules in the linked services or not.
KPI threshold templates Choose to update the threshold templates for all KPIs, no KPIs, or only unchanged KPIs in the linked services.
Health score Choose whether to overwrite the KPI importance values in the linked services with the importance values in the template. KPIs that exist in the service but not the template and dependent KPI values are not affected by overwriting.

Service templates differ from services in the following ways:

  • Templates don't contain a service health score.
  • Template KPIs can only use a base search, not ad hoc or data model searches.
  • Templates don't have service dependencies. You must define dependencies in individual services.
  • Templates allow entity values to be defined in the linked services rather than in the template. These are known as configurable entity rules.
  • You can't enable detection for KPIs in a template. You must manually enable it for KPIs in individual services.

Templates exist in the Global team. You must have write access to the Global team and the write capability for service templates in order to create service templates. By default, only the itoa_admin possesses this capability.

Team admins (users with a role that inherits from the itoa_team admin role) can create services for their teams using service templates. The same template can be used for services in different teams. Dependent services do not have to be linked to the same service template as the parent service.

The higher the number of services linked to a service template, the higher the number of KPIs that use the same base search. For example, if a service template has 10 KPIs and is linked to 12 services, each KPI base search in the template is being used 12 times, once for each of the linked services. If the same KPI base search is used by too many services, this can lead to performance issues. See KPI base search performance considerations for information.

Service template use cases

The following use cases illustrate how using service templates can streamline the process of creating and maintaining services.

Create one or more services from a service template

In this example, as the ITSI administrator, you need to create multiple services to monitor databases. Each service needs the same set of KPIs: Database Service Errors, Database Service Response Time, Storage Free Space: %, and CPU Utilization: %. However, each service will be monitoring different database servers (entities). One service needs to be filtered to the servers running Oracle database and another service needs to be filtered to the servers running MySQL.

  1. A database service already exists that has the KPIs you want your services to have. You use this service to create a Database service template by selecting Edit > Create Service Template from the Services viewer page.
  2. You name the template "Database service template" and click Create. The service template receives the entity rules, KPIs, KPI thresholds, and KPI importance values from the service.
  3. The Database service didn't have any entity filtering rules, so you decide to add some entity rules to the template.
    First you add a rule that filters the template down to all entities that have "Category matches database." This helps you narrow down the entities that have a database installed, but you need a way to differentiate between the different services. To do this, you add a configurable entity rule. This allows you to select a key to filter on whose value will be defined in each service linked to the template. You add the following entity rule to the Database template: "host matches a value defined in the service".
  4. Save the template and select to overwrite the entity rules so that the entity rules you added in the template will be added to the Database service that you used to create the template. You push the changes immediately and see the new entity rules in the Database service.
  5. Now you are ready to create the new services based on the service template.
    You create a new service named "Oracle database service" and select the option to Link service to a service template and select the Database service template you created. Then you create a "MySQL database service" using the Database service template. These two services are now linked to the template and have received the entity rules and KPIs from the service template.
  6. You open the Entity tab of the service definition for the Oracle Database service. You see an empty value for the host entity rule that the service received from the template. Specify the value for the host entity rule as oracle* since all the Oracle hosts begin with "oracle", for example: oracle-01, oracle-02, oracle-03.
    In the service definition of the MySQL service, specify a value of mysql* since all the MySQL hosts begin with "mysql," for example: mysql-01, mysql-02, mysql-03. Now the KPIs that are filtered to entities (such as Database Service Errors, Storage Free Space: %, and CPU Utilization: %) will be filtered to the appropriate hosts for each service.
  7. You decide to go back to the template to make sure that KPI thresholds are set up properly. You select an adaptive threshold template for a KPI and apply it. You look over the preview and toggle it between each linked service to make sure it makes sense for each of the services. You know that if one of the services requires a custom adaptive threshold settings, that you can make that change in the service and choose to only overwrite KPI thresholds for unchanged KPIs when changes are pushed from the template in the future.
  8. You also decide to adjust the KPI importance value for one of the KPIs.
  9. When you save the template, you choose to overwrite KPI thresholds and overwrite health score so that the KPI thresholds and KPI importance values in the services will be overwritten with the new ones you just added to the template.
  10. So as not to cause disruption to the Splunk environment, you schedule the changes to be pushed to the linked services at 12:00am when the system should not be as busy.
  11. The next morning, you see that the updates have been propagated to the database services.

See Also

Customize a service that is linked to a service template

The team admin who administers the Oracle database service in ITSI uses a custom plug-in with their Oracle database. She wants to add a KPI that checks the status of the plug-in. Because this KPI does not apply to every service linked to the Database service template, you are hesitant to add it to the Database service template. You tell the team admin to add the KPI to the service.

  1. The team admin opens the service definition of the Oracle Database service and adds the KPI to monitor the plug-in and saves it.
  2. The next time the ITSI admin updates the Database service template, this unique KPI for the Oracle Database service is not modified.

See Also

Bulk import services and link them to a service template

The director of IT has asked you to create Apache services for every Apache instance in the company. There are dozens of instances and you realize you cannot do this manually. You decide to use the ITSI bulk import feature. An Apache service template already exists with a configurable entity rule to filter entities by a different value for each linked service.

  1. You query the CMDB and pull down a list of every Apache service in the company. You export the list as a CSV file and open it in Excel.
  2. You add a new column that denotes the template each service will map to. In it you write "Apache Service Template" and copy it for every row.
  3. You open up the ITSI bulk import and upload the CSV. You map the proper columns that denote the service name, service dependencies, and service template name.
  4. After examining the bulk import preview, you decide the import looks good and move on to the entity configuration step. All of the services have a column called "serviceoid." This makes it very easy to map the entities for each service. You set the configurable entity rule for the Apache template to map to the values in the serviceoid column.
  5. You click Import and all of your services are created and linked to the Apache service template.

See Also

Schedule KPI searches to update at the same time in ITSI
Create a service template in ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.1.0, 4.1.1, 4.1.2, 4.1.5, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1, 4.4.0, 4.4.1, 4.4.2

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters