Splunk® IT Service Intelligence

Install and Upgrade Splunk IT Service Intelligence

Download manual as PDF

Download topic as PDF

Troubleshoot an upgrade of IT Service Intelligence

Use this information to troubleshoot post-upgrade issues.

Why are things missing after I upgrade?

If some objects, such as service analyzers, glass tables, or deep dives, are missing from the UI or unaccessible after you upgrade, the ACL objects corresponding to the objects might be missing or corrupted.

  1. See if the object exists in the KV store. Even if it does exist, there could be duplicates, which you'll address in the next step. Check the list of knowledge objects by name at the following endpoints:

    The value of the _key attribute is called obj_id or object ID in the next steps.

  2. Check if a corresponding ACL object exists with the ID of the object you're looking for at the following endpoint: https://localhost:8089/servicesNS/nobody/SA-UserAccess/storage/collections/data/app_acl
    1. If one ACL object exists with the corresponding object ID, and the object is still missing from the UI, contact Splunk Support.
    2. If two ACL objects exists with the corresponding object ID, delete one of them by running the following command:
      curl -k -u admin:changeme -X DELETE https://io-itsintly1-sh.sv.splunk.com:8089/servicesNS/nobody/SA-UserAccess/storage/collections/data/app_acl/<ACL_ID>
      
    3. If no ACL object exists with the corresponding object ID, manually create an ACL object with the following command:
      curl -k -u <ADMIN_USER>:<PASSWORD> https://<HOST>:<ADMIN_PORT>/servicesNS/nobody/SA-UserAccess/storage/collections/data/app_acl -H "Content-Type: application/json" -X POST -d '{"obj_type":"<OBJ_TYPE>","acl_owner":"nobody","acl_id":"<ACL_ID>","obj_id":"<OBJ_ID>","_user":"nobody","obj_shared_by_inclusion":true,"obj_acl":{"delete":["*"],"write":["*"],"obj_owner":"nobody","read":["*"]},"_key":"<ACL_ID>","obj_storename":"<OBJ_STORENAME>","obj_app":"itsi"}'

      Replace the tokens with the following values:

      Object name OBJ_TYPE OBJ_STORENAME OBJ_ID ACL_ID
      Service analyzer home_view itsi_service_analyzer ID of the missing object unique ID
      Deep dive deep_dive itsi_pages ID of the missing object unique ID
      Glass table glass_table itsi_pages ID of the missing object unique ID
      Episode review event_management_state itsi_event_management ID of the missing object unique ID
      Notable event aggregation policy notable_aggregation_policy itsi_notable_event_aggregation_policy ID of the missing object unique ID
      Correlation search correlation_search itsi_correlation_search ID of the missing object unique ID

      ACL_ID must be a unique value.

Why is the Global team gone after I upgrade?

The Teams feature introduced in version 3.0 requires that all services be assigned to a team. When upgrading to ITSI 3.0 or later from a version of ITSI prior to 3.0, the migration script creates the default team, Global, in the KV store and assigns all existing services to the Global team.

If this step in the migration fails, you receive the error "Failed to import Team settings" and ITSI is unusable. If you encounter this error when upgrading to version 3.0, download and install ITSI version 3.0.1. ITSI 3.0.1 contains a Python script called itsi_reset_default_team.py in the apps/SA-ITOA/bin directory. Running this script manually creates the Global team in the KV store which completes the migration.

If you encounter this error when upgrading to version 3.0.1 from a version prior to 3.0, manually run the Python script included in version 3.0.1.

To run the itsi_reset_default_team.py script in version 3.0.1:

  1. Run the following command on any search head in your ITSI deployment:
    cd $SPLUNK_HOME/etc/apps/SA-ITOA/bin
    $SPLUNK_HOME/bin/splunk cmd python itsi_reset_default_team.py
  2. Provide the splunkd port number and your Splunk username and password when prompted.
  3. After the script has successfully finished, the Global group is created in the KV store.
  4. Restart your Splunk software.

Install version 3.0.1 rather than downloading and running the itsi_reset_default_team.py file from the ITSI 3.0.1 installation package. ITSI version 3.0.1 has better error logging than version 3.0. In the event that the script does not work, version 3.0.1 provides more information on the reason for the failure.

PREVIOUS
Upgrade IT Service Intelligence in a search head cluster environment
  NEXT
Configure users and roles in ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1, 4.4.0


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters