Splunk® IT Service Intelligence

SAI Integration

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Overview of creating an ITSI service using an SAI service template

An ITSI service is a representation of a real-world IT service that lets you monitor the health of IT systems and business processes. Use an SAI service template to create an ITSI service from Splunk App for Infrastructure (SAI) entities. The template populates the service with pre-built KPIs and entity rules as defined in the service template.

For instructions on creating a service using SAI entities, see Create a single ITSI service using an SAI service template.

SAI service templates

ITSI ships with four predefined SAI service templates that are based on the operating system of your Splunk deployment. Use these templates to create services from Splunk App for Infrastructure entities. The SAI service template populates the service with pre-built KPIs and entity rules. KPI thresholds are configured by default, while entity rules require some configuration while you're creating the service.

The following table describes the supported operating systems and KPIs in each service template.

SAI service template Supported OS type KPIs contained in the template
Cloud KPIs - AWS EBS (SAI) AWS EBS deployment type displays as VolumeId
  • AWS/EBS Burst Balance
  • AWS/EBS Queue Length
  • AWS/EBS Volume Idle Time
  • AWS/EBS Volume Total I/O MB
  • AWS/EBS Volume Total I/O Time
  • AWS/EBS Volume Total Operations
Cloud KPIs - AWS EC2 (SAI) AWS EC2 deployment type displays as InstanceId
  • AWS/EC2 CPU Utilization
  • AWS/EC2 Disk Total I/O MB
  • AWS/EC2 Disk Total I/O Operations
  • AWS/EC2 Network Total I/O MB
  • AWS/EC2 Network Total Packets
  • AWS/EC2 Status Checks Failed
OS KPIs - *nix (SAI)

Supported *nix distributions include:

  • CentOS
  • Debian
  • Fedora
  • Mac OS X
  • Red Hat
  • Solaris
  • SUSE
  • Ubuntu
  • CPU Active %
  • Disk IO Weighted Time
  • Disk Queue - Pending Operations
  • IO Wait %
  • Load Ave - 1 minute
  • Load Ave - 15 minute
  • Load Ave - 5 minute
  • Network Bandwidth MB/s
  • Network Errors
  • Network Packet Drop %
  • Storage Used %
OS KPIs - Windows (SAI)

Supported Windows versions include:

  • Microsoft Windows Server 2012
  • Microsoft Windows 10
  •  % Disk I/O Time
  •  % Free Disk Space
  •  % Memory Committed in Use
  • Network I/O MBs
  • Network I/O Packets per Second
  • Processor Active Time %
  • Processor Queue Length

SAI service templates do not support creating services with AWS ELB deployments. You must create and configure a single service manually.

Entity rules for SAI service templates when creating ITSI services

When creating an ITSI service using an SAI service template, you must configure entity rules to filter the SAI entities to the service. Enter SAI group dimensions (group filters) as entity rules when creating a service, enabling the dimensions to act as the filters to match the entities to the service. See the Example of entity rules defined in an SAI service template.

SAI service template Enter the dimension value(s) to complete the entity rule
Cloud KPIs - AWS EBS (SAI)
  • Info itsi_role matches SAI
  • Alias VolumeId matches *
  • Info region matches <value to be defined in the service>
  • Add all additional group dimensions as Info entity rules
Cloud KPIs - AWS EC2 (SAI)
  • Info itsi_role matches SAI
  • Alias InstanceId matches *
  • Info region matches a <value to be defined in the service>
  • Add all additional group dimensions as Info entity rules
OS KPIs - *nix (SAI)
  • Info itsi_role matches SAI
  • Info os does not match Microsoft*
  • Alias host matches CHANGEME
  • Add all additional group dimensions as Info entity rules


Note: You can include more than one *nix OS type dimension in the entity rule. For example, centos and ubuntu.

OS KPIs - Windows (SAI)
  • Info itsi_role matches SAI
  • Info entity_type matches Windows_Host
  • Info os matches Microsoft*
  • Alias host matches CHANGEME
  • Add all additional group dimensions as Info entity rules

Define entity rules when using an SAI service template to create a service

In this example, you want to create a new ITSI service for the entities contained in an SAI group. In order to do this, you use an SAI service template to create the service. Now you need to define entity rules to filter the service to the entities in the SAI group.

For this example, you have created a new service in ITSI named "Server Group - Staging", that mirrors an SAI group named "Server Group - Staging". You must define the entity rules in the new service to match the SAI group filter dimensions. By matching the entity rules with the SAI group filter dimensions, SAI entities that have been ingested into ITSI map to the new service and mirror the SAI group.

  1. In ITSI, after you create the new service called "Server Group - Staging" using the "OS KPIs - *nix (SAI)" service template, the service is populated with default entity rules as defined in the template, as shown in the following example.
    The Info itsi_role matches SAI entry is a required entity rule for the service; do not remove it. You can edit the field values for the other default entity rules, and you can add more rules based on the dimensions of the SAI group.
    SAI ITSI entity rules1.jpg
  2. In SAI, find the group and group filter dimensions as shown in the following image. Note the group filter dimensions so you can add them as entity rules in the new service in ITSI. SAI group dimensions example.jpg
  3. In ITSI, enter the SAI group filter dimensions as entity rules in the new service, replacing default entity rule values and adding any additional group filter dimensions as entity rules. The matching entities in ITSI are displayed. Make sure that these entities match the entities contained in the SAI group. SAI ITSI entity rules2.jpg
  4. Click Save.

Summary of changes that unlink a service from an SAI service template

When a service is linked to an SAI service template, you can customize some attributes of the service that are unique to the service.

You can make the following changes to a service without breaking the link to an SAI service template:

  • Update KPI thresholds.
  • Enable anomaly detection for a KPI.
  • Update KPI importance values which contribute to the service health score.

The following changes to a service will break the link to an SAI service template:

  • Add a KPI.
  • Modify an unlinked KPI (a KPI that does not display a lock icon).
  • Modify the name of a linked KPI.
  • Modify the base search of a linked KPI (or modifying any other settings in the Search and Calculate section, including enabling backfill).
  • Delete a linked KPI.
  • Add, modify, or delete entity rules.

Linked KPIs have a lock icon Lock.png next to the name of the KPI in the KPI tab of the service definition.

If you clone a service that is linked to a template, the clone will also be linked to the service template.

Last modified on 22 July, 2019
PREVIOUS
Group alerts from the Splunk App for Infrastructure in ITSI
  NEXT
Create a single ITSI service using an SAI service template

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.3.0, 4.3.1, 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5, 4.5.0 Cloud only, 4.5.1 Cloud only, 4.6.0 Cloud only, 4.6.1 Cloud only, 4.6.2 Cloud only, 4.7.0, 4.7.1, 4.7.2, 4.8.0 Cloud only, 4.8.1 Cloud only


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters