Splunk® IT Service Intelligence

User Manual

Acrobat logo Download manual as PDF

Splunk IT Service Intelligence version 4.5.x will no longer be supported as of April 29, 2022. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see Before you upgrade IT Service Intelligence.
This documentation does not apply to the most recent version of Splunk® IT Service Intelligence. Click here for the latest version.
Acrobat logo Download topic as PDF

Analyze every recent log event for an entity in the ITSI Event Data Search Dashboard

The Event Data Search dashboard in IT Service Intelligence (ITSI) displays the 100 most recent log events associated with an entity for the last 60 minutes. The dashboard provides a high-level overview of entity performance across your whole environment, regardless of the entity type you associated with the entity. The dashboard only populates for entities that have log data sources.

The Event Data Search dashboard uses entity aliases to aggregate recent log events. Entity aliases are field-value pairs that identify an entity. If you manually create or import entities, specify entity aliases when you bring them in to ITSI. Entities you create with entity integrations have default aliases to identify the entity with. If you don't include an entity alias for an entity, Event Data Search doesn't populate with any log events for the entity. To add an entity alias to an entity, see Add an alias to an entity in ITSI in the Entity Integrations Manual.

To populate the Event Data Search dashboard for an entity, ITSI runs a Splunk search that looks for every log event that contains at least one alias for the entity. For instance, ITSI could populate Event Data Search with a search for an entity's host:


Note: This search doesn't include the index field while the Entity Analysis Dashboard's search does. This might lead to inconsistent logs for the two dashboards. For more information, see Investigate entity metrics and logs in the ITSI Entity Analysis Dashboard.

If an entity has multiple alias fields, the Splunk search separates each alias with an OR operator. You could open the search in the Search and Reporting app to view more events over a longer time period, and to further customize the search. Go to the Event Data Search tab for an entity to view the search and open it in the Search and Reporting app.

For more information about how ITSI visualizes entity data, see How ITSI visualizes entity data in the Entity Integrations Manual.

Find Event Data Search for an entity

Follow these steps to access the Event Data Search dashboard for an entity.

  1. From the ITSI main menu, click Configuration > Entities.
  2. Find the entity you want to analyze. Use the basic or advanced filter to narrow down your search, if needed. When you find the entity you want to analyze, click View Health under the Health Column of the entities lister page.
  3. Select the Event Data Search tab for the entity.
Last modified on 09 June, 2020
ITSI Health Check dashboard
Investigate entity metrics and logs in the ITSI Entity Analysis Dashboard

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.5.0 Cloud only, 4.5.1 Cloud only

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters