Splunk® IT Service Intelligence

Administration Manual

Acrobat logo Download manual as PDF

Splunk IT Service Intelligence version 4.4.x will no longer be supported as of October 22, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see Before you upgrade IT Service Intelligence.
This documentation does not apply to the most recent version of ITSI. Click here for the latest version.
Acrobat logo Download topic as PDF

Update a service template in ITSI

Make updates to a service template to update all the services linked to the template. You can choose to push updates to the linked services immediately or schedule a specific date and time to push the updates.

  1. Click Configure > Service Templates.
  2. Open a service template.
  3. On the Entities tab, add, modify, or delete entity rules as desired.
    (Optional) Use the matches a value to be defined in the service or does not match a value to be defined in the service options to specify the value for an entity rule in each service rather than in the template. These settings are useful if each service linked to the template will be monitoring different entities.

    If you use the configurable entity rules described above and choose Overwrite Entity Rules when you save the service template, any entity rules already defined in the linked services are replaced with the entity rules from the template and have blank values (matching all entities).

  4. On the KPI tab, add, modify, or delete the KPIs in the template, and set KPI thresholds as desired. Any KPIs you add to the template must use a base search. Template KPIs cannot use ad hoc, metrics, or data model searches.

    You cannot enable anomaly detection in a service template. You must enable anomaly detection for a KPI in the service directly.

  5. On the Settings tab, set importance values for the KPIs and see how they affect the health score of linked services.
  6. When you finish making modifications to the service template, click Save.
  7. Indicate what information to update and select when to push the changes to the linked services.
    Setting Description
    Overwrite entity rules Replaces the entity rules in the linked services with the entity rules in the template.
    Overwrite KPI thresholds and alerting rules on How to update KPI thresholds and KPI alerting rules in linked services.
    • Select All KPIs to overwrite all KPIs in all linked services, including any that you've customized since you last saved the template.
    • Select All Unchanged KPIs if you customized some of the KPI thresholds or alerting rules in the linked services and you don't want to override those changes.
    • Select No KPIs if you don't want to update any KPIs in the linked services.

    This setting doesn't affect thresholds or alerting rules for KPIs that are unique to a service and not linked to the template.

    Overwrite health score calculation Replaces the KPI importance values used to calculate the health score in the linked services with the values from the template. KPI importance values for any additional KPIs in the service that are not present in the template are not affected. Importance values for dependent services are also not affected.
    Push changes to services When to push the changes to the linked services. Either push the changes immediately, or select Later to choose a date and time to update the linked services. It is considered a best practice to push changes outside of regular business hours to avoid disruption.
  8. Click Save. The changes in the template are immediately propagated to the linked services if you chose to push the changes now, or scheduled for the date and time you selected.
  9. Click the Linked Services tab to see the sync status of the services linked to the template.

After the linked services are synced with the template, the status says "Synced". If you elected to push the changes now, you might need to refresh your browser to see the status change. You will also receive a message in Splunk Web with the status of the sync.

You can only schedule one sync for a service template. If you make additional updates to a service template that is already scheduled, you can keep the scheduled time (the default) or choose to sync now or at a different time. All updates that have been made to the template are pushed at the time you choose.

Last modified on 04 March, 2020
Link a service to a service template in ITSI
Unlink a service from a service template in ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1, 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters