Splunk® IT Service Intelligence

Administer Splunk IT Service Intelligence

Download manual as PDF

Download topic as PDF

Configure a service created from a service template in ITSI

After creating a service from a service template, review the content the service received from the template. Entity rules, KPIs, KPI threshold values, and KPI importance values are populated from the template. However, you must do some service configuration directly in the service:

  • If the service template contains blank entity rules whose values need to be specified in the service, you must provide those in the service entity rules.
  • If you want to enable anomaly detection or configure custom thresholds for any of the KPIs, you must do this in the service.
  • If the service has service dependencies, you need to specify them in the service.

To finish configuring the service, perform the following steps:

1. Review the entity rules

  • The entity rules from the template are added to the service.
  • Any entity rules without values that came from the template contain a Blank entity value.png icon. Provide a value in order to filter the service to a specific set of entities. These entity rule values are meant to be custom for each service. Some entity rules might have blank values intentionally and don't display the notification icon.
  • Add or change entity rules as desired for the service. For more information, see Add entity rules to a service in ITSI. You can choose to preserve any custom entity rules you define in the service when you update the service template.

2. Review the KPIs

  • The KPIs in the template are added to the linked service. These KPIs display a lock icon Lock.png to indicate that they're linked to the template. Now you can set custom thresholds and enable anomaly detection for linked KPIs. For more information, see Apply anomaly detection in ITSI and Add a KPI to a service in ITSI.

    Making any other changes to a linked KPI, such as deleting it or changing its name, unlinks the service from the template.

  • Add any new KPIs that are specific to this service. These KPIs are not overwritten when you update the service template. KPIs added directly to the service do not have a lock icon which indicates they are not tied to the service template. See Add KPIs to a service in ITSI for information.

3. Specify service dependencies

On the Service Dependencies tab, add other services as impacting services, or service dependencies. Dependencies are not included in service templates so you must configure them manually for each service. For more information, see Add service dependencies in ITSI.

4. Set KPI importance values

On the Settings tab, change the team the service belongs to or configure KPI importance values. You can preserve custom KPI importance values for a service, which determine the service health score, when you update the service template. For more information, see Set KPI importance values in ITSI.

Any changes you make to the service apply to the service only. Edit the service template if you want to make changes that propagate to all services linked to the template.

Summary of changes that unlink a service from its service template

When a service is linked to a service template, you generally want to make updates to the template and not the service itself. However, you can customize some attributes of the service that are unique to the service.

You can make the following changes to a service without breaking the link to the service template:

  • Add a KPI
  • Modify an unlinked KPI (a KPI that does not display a lock icon)
  • Update KPI thresholds
  • Enable anomaly detection for a KPI
  • Update KPI importance values which contribute to the service health score
  • Add, modify, or delete entity rules

The following changes to a service will break the link to the service template:

  • Modifying the name of a linked KPI
  • Modifying the base search of a linked KPI (or modifying any other settings in the Search and Calculate section, including enabling backfill)
  • Deleting a linked KPI

Linked KPIs have a lock icon Lock.png next to the name of the KPI in the KPI tab of the service definition.

If you clone a service that is linked to a template, the clone will also be linked to the service template.

Create a service template in ITSI
Update a service template in ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.1.0, 4.1.1, 4.1.2, 4.1.5, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1, 4.4.0, 4.4.1, 4.4.2

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters