Removed features in Splunk IT Service Intelligence

This page lists computing platforms, browsers, and features for which IT Service Intelligence (ITSI) has deprecated or removed support.

REST calls through SPL searches without "report_as" parameter

The default header Content-Type: application/json was added to all /SA-ITOA/... endpoint responses. The response body will continue to be JSON. However, in the context of Splunk search, customers who want to continue using | REST for ITSI endpoints must add report_as=text to their searches.

For version 4.3.1, the following Splunk searches are deprecated if the report_as parameter is not used. They work in 4.3.1, but display a warning in the Search Job Inspector:

| REST splunk_server=local /servicesNS/nobody/SA-ITOA/itoa_interface/... fields="_key,title" | eval(...)

The search must be changed to the following:

| REST splunk_server=local /servicesNS/nobody/SA-ITOA/itoa_interface/... fields="_key,title" report_as=text| eval(...)

In the next major ITSI release, searches without report_as will stop working completely.

Partial backup using kvstore_to_json.py mode 1

You can no longer perform partial backups using the kvstore_to_json.py mode 1 option. Use the partial backup workflow in the UI instead. For information, see Create a partial backup in the Administer Splunk IT Service Intelligence manual.

Event Management SDK

The Event Management SDK is deprecated and no longer supported. The documentation will be removed in the next major ITSI release. If you have scripts based on this refactored SDK, you can continue using them, but it is recommended to eventually port them to use the original Notable Event Actions SDK that is shipped with ITSI, as it will be updated going forward.

Module builder - ADVANCE NOTICE

Support for the Module Builder is deprecated in version 4.3.0. The Module Builder will be completely removed in the next major ITSI release. For information, see Module Builder in the ITSI Modules manual.