Troubleshoot SAI integration with ITSI

Perform the following troubleshooting steps when you encounter issues with the SAI integration with ITSI.

Entities from SAI are not imported into ITSI

If entities exist in SAI and you enabled entity integration but you do not see the entities listed in the ITSI Entity lister page, perform the following troubleshooting steps:

• On the ITSI search head click Settings > Data Inputs and make sure the Splunk App for Infrastructure - Entity Migration data input is enabled. ITSI can't ingest entities unless this data input is enabled.
• Check the internal logs for errors by running the following search search:
  

  index=_internal error em_entity_migration

• Check the following endpoint, which shows the entities that are published to the entity exchange.
  https://<splunk host>:8089/servicesNS/nobody/SA-ITOA/storage/collections/data/itoa_entity_exchange_entities.
  ITSI can't import entities if no entities are published to the entity exchange.

Alerts from SAI are not imported into ITSI

If you turned on integration for SAI alerts but don't see notable events for them in the ITSI Episode Review, confirm that SAI is generating alerts into the infra_alerts index.

Run the following search and review whether events are returned.

index=infra_alerts

If no events are returned, make sure the Splunk Add-on for Infrastructure is installed correctly because the add-on handles all indexing for the Splunk App for Infrastructure. See the Splunk Add-on for Infrastructure documentation for information.

If events are returned but you don't see the alerts as notable events in ITSI, make sure the Splunk App for Infrastructure Alerts correlation search is enabled.

The "Manage Integrations" button doesn't appear on the entity lister page

Click Settings > Data Inputs and make sure the Splunk App for Infrastructure - Entity Migration data input is enabled. ITSI cannot ingest entities unless this data input is enabled.