Splunk® IT Service Intelligence

SAI Integration

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Troubleshoot SAI integration with ITSI

Perform the following troubleshooting steps when you encounter issues with the SAI integration with ITSI.

Entities from SAI are not imported into ITSI

If entities exist in SAI and you enabled entity integration but you do not see the entities listed in the ITSI Entity lister page, perform the following troubleshooting steps:

  • On the ITSI search head click Settings > Data Inputs and make sure the Splunk App for Infrastructure - Entity Migration data input is enabled. ITSI can't ingest entities unless this data input is enabled.
  • Check the internal logs for errors by running the following search search:

    index=_internal error em_entity_migration

  • Check the following endpoint, which shows the entities that are published to the entity exchange.
    https://<splunk host>:8089/servicesNS/nobody/SA-ITOA/storage/collections/data/itoa_entity_exchange_entities.
    ITSI can't import entities if no entities are published to the entity exchange.

Alerts from SAI are not imported into ITSI

If you turned on integration for SAI alerts but don't see notable events for them in the ITSI Episode Review, confirm that SAI is generating alerts into the infra_alerts index.

Run the following search and review whether events are returned.

index=infra_alerts

If no events are returned, make sure the Splunk Add-on for Infrastructure is installed correctly because the add-on handles all indexing for the Splunk App for Infrastructure. See the Splunk Add-on for Infrastructure documentation for information.

If events are returned but you don't see the alerts as notable events in ITSI, make sure the Splunk App for Infrastructure Alerts correlation search is enabled.

The "Manage Integrations" button doesn't appear on the entity lister page

Click Settings > Data Inputs and make sure the Splunk App for Infrastructure - Entity Migration data input is enabled. ITSI cannot ingest entities unless this data input is enabled.

Last modified on 02 March, 2020
PREVIOUS
Create a single ITSI service using an SAI service template
 

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1, 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5, 4.5.0 Cloud only, 4.5.1 Cloud only, 4.6.0 Cloud only, 4.6.1 Cloud only, 4.6.2 Cloud only, 4.7.0, 4.7.1, 4.8.0 Cloud only


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters