Create and manage saved searches in ITSI
Create a saved search, also called a scheduled report, in Splunk IT Service Intelligence. You can use these saved searches when importing entities and services.
- Click Settings > Searches, Reports, and Alerts.
- Click New Report. When you define a report in Settings, you set it up as a saved search. It appears as a report on the lister page when you're done.
- Provide a title in the format "IT Service Intelligence - <custom text>". For example,
IT Service Intelligence - get my entities. This format is required for the saved search to show up when importing entities and services from a saved search in ITSI.
- Provide a search string under Search.
- (Optional) Provide the search Earliest time and Latest time using relative time modifiers. If you want the search to run over all time, leave these fields blank.
- For App, select IT Service Intelligence (its).
- Click Save.
- After the search saves, locate the search on the lister page and click Edit > Edit Permissions.
- For Display For, select All apps.
- Click Save.
- Restart Splunk software to add the search to savedsearches.conf.
The search now appears in the list of predefined ITSI saved searches when you import services and entities.
kvstore_to_json.py operations in ITSI
ITSI summary index reference
This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.1.1, 4.1.2, 4.1.5, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1, 4.4.0, 4.4.1, 4.4.2, 4.4.3