Troubleshoot SAI integration with ITSI
Perform the following troubleshooting steps when you encounter issues with the SAI integration with ITSI.
Entities from SAI are not imported into ITSI
If entities exist in SAI and you enabled entity integration but you do not see the entities listed in the ITSI Entity lister page, perform the following troubleshooting steps:
- On the ITSI search head click Settings > Data Inputs and make sure the
Splunk App for Infrastructure - Entity Migrationdata input is enabled. ITSI can't ingest entities unless this data input is enabled.
- Check the internal logs for errors by running the following search search:
index=_internal error em_entity_migration
- Check the following endpoint, which shows the entities that are published to the entity exchange.
ITSI can't import entities if no entities are published to the entity exchange.
Alerts from SAI are not imported into ITSI
If you turned on integration for SAI alerts but don't see notable events for them in the ITSI Episode Review, confirm that SAI is generating alerts into the
Run the following search and review whether events are returned.
If no events are returned, make sure the Splunk Add-on for Infrastructure is installed correctly because the add-on handles all indexing for the Splunk App for Infrastructure. See the Splunk Add-on for Infrastructure documentation for information.
If events are returned but you don't see the alerts as notable events in ITSI, make sure the Splunk App for Infrastructure Alerts correlation search is enabled.
Click Settings > Data Inputs and make sure the
Splunk App for Infrastructure - Entity Migration data input is enabled. ITSI cannot ingest entities unless this data input is enabled.
Create a single ITSI service using an SAI service template
This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1, 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5, 4.5.0 Cloud only, 4.5.1 Cloud only, 4.6.0 Cloud only, 4.6.1 Cloud only, 4.6.2 Cloud only, 4.7.0, 4.7.1, 4.8.0 Cloud only