Update a service template in ITSI
Make updates to a service template to update all the services linked to the template. You can choose to push updates to the linked services immediately or schedule a specific date and time to push the updates.
- Click Configure > Service Templates.
- Open a service template.
- On the Entities tab, add, modify, or delete entity rules as desired.
Use the matches a value to be defined in the service or does not match a value to be defined in the service options to specify the value for an entity rule in each service rather than in the template. This is useful if each service linked to the template will be monitoring different entities. For example, you could specify
matches a value defined in the service. Then, after the services have been synced with the template, specify the value for
vm_namein each service. These options are particularly useful if you plan to bulk import services and link them to the template.
If you use the configurable entity rules described above and choose Overwrite Entity Rules when you save the service template, any entity rules already defined in the linked services are replaced with the entity rules from the template and have blank values (matching all entities).
- On the KPI tab, add, modify, or delete the KPIs in the template, and set KPI thresholds as desired. Any KPIs you add to the template must use a base search. Template KPIs cannot use ad hoc, metrics, or data model searches.
You cannot enable anomaly detection in a service template. You must enable anomaly detection for a KPI in the service directly.
- On the Settings tab, set importance values for the KPIs and see how they affect the health score of linked services.
- When you finish making modifications to the service template, click Save.
- In the Save Service Template dialog box, indicate what information to update and select when to push the changes to the linked services.
Setting Description Overwrite entity rules Replaces the entity rules in the linked services with the entity rules in the template. Overwrite KPI thresholds and alerting rules on How to update KPI thresholds and KPI alerting rules in linked services.
- Select All KPIs to overwrite all KPIs in all linked services, including any that you've customized since you last saved the template.
- Select All Unchanged KPIs if you customized some of the KPI thresholds or alerting rules in the linked services and you don't want to override those changes.
- Select No KPIs if you don't want to update any KPIs in the linked services.
This setting doesn't affect thresholds or alerting rules for KPIs that are unique to a service and not linked to the template.
Overwrite health score calculation Replaces the KPI importance values used to calculate the health score in the linked services with the values from the template. KPI importance values for any additional KPIs in the service that are not present in the template are not affected. Importance values for dependent services are also not affected. Push changes to services When to push the changes to the linked services. Either push the changes immediately, or select Later to choose a date and time to update the linked services. It is considered a best practice to push changes outside of regular business hours to avoid disruption.
- Click Save. The changes in the template are immediately propagated to the linked services if you chose to push the changes now, or scheduled for the date and time you selected.
- Click the Linked Services tab to see the sync status of the services linked to the template.
After the linked services are synced with the template, the status says "Synced". If you elected to push the changes now, you might need to refresh your browser to see the status change. You will also receive a message in Splunk Web with the status of the sync.
You can only schedule one sync for a service template. If you make additional updates to a service template that is already scheduled, you can keep the scheduled time (the default) or choose to sync now or at a different time. All updates that have been made to the template are pushed at the time you choose.
Configure a service created from a service template in ITSI
Link a service to a service template in ITSI
This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1, 4.4.0, 4.4.1