Overview of creating an ITSI service using an SAI service template
An ITSI service is a representation of a real-world IT service that lets you monitor the health of IT systems and business processes. Use an SAI service template to create an ITSI service from Splunk App for Infrastructure (SAI) entities. The template populates the service with pre-built KPIs and entity rules as defined in the service template.
For instructions on creating a service using SAI entities, see Create a single ITSI service using an SAI service template.
SAI service templates
ITSI ships with four predefined SAI service templates that are based on the operating system of your Splunk deployment. Use these templates to create services from Splunk App for Infrastructure entities. The SAI service template populates the service with pre-built KPIs and entity rules. KPI thresholds are configured by default, while entity rules require some configuration while you're creating the service.
The following table describes the supported operating systems and KPIs in each service template.
|SAI service template||Supported OS type||KPIs contained in the template|
|Cloud KPIs - AWS EBS (SAI)||AWS EBS deployment type displays as VolumeId||
|Cloud KPIs - AWS EC2 (SAI)||AWS EC2 deployment type displays as InstanceId||
|OS KPIs - *nix (SAI)||
Supported *nix distributions include:
|OS KPIs - Windows (SAI)||
Supported Windows versions include:
SAI service templates do not support creating services with AWS ELB deployments. You must create and configure a single service manually.
Entity rules for SAI service templates when creating ITSI services
When creating an ITSI service using an SAI service template, you must configure entity rules to filter the SAI entities to the service. Enter SAI group dimensions (group filters) as entity rules when creating a service, enabling the dimensions to act as the filters to match the entities to the service. See the Example of entity rules defined in an SAI service template.
|SAI service template||Enter the dimension value(s) to complete the entity rule|
|Cloud KPIs - AWS EBS (SAI)||
|Cloud KPIs - AWS EC2 (SAI)||
|OS KPIs - *nix (SAI)||
|OS KPIs - Windows (SAI)||
Define entity rules when using an SAI service template to create a service
In this example, you want to create a new ITSI service for the entities contained in an SAI group. In order to do this, you use an SAI service template to create the service. Now you need to define entity rules to filter the service to the entities in the SAI group.
For this example, you have created a new service in ITSI named "Server Group - Staging", that mirrors an SAI group named "Server Group - Staging". You must define the entity rules in the new service to match the SAI group filter dimensions. By matching the entity rules with the SAI group filter dimensions, SAI entities that have been ingested into ITSI map to the new service and mirror the SAI group.
- In ITSI, after you create the new service called "Server Group - Staging" using the "OS KPIs - *nix (SAI)" service template, the service is populated with default entity rules as defined in the template, as shown in the following example.
Info itsi_role matches SAIentry is a required entity rule for the service; do not remove it. You can edit the field values for the other default entity rules, and you can add more rules based on the dimensions of the SAI group.
- In SAI, find the group and group filter dimensions as shown in the following image. Note the group filter dimensions so you can add them as entity rules in the new service in ITSI.
- In ITSI, enter the SAI group filter dimensions as entity rules in the new service, replacing default entity rule values and adding any additional group filter dimensions as entity rules. The matching entities in ITSI are displayed. Make sure that these entities match the entities contained in the SAI group.
- Click Save.
Summary of changes that unlink a service from an SAI service template
When a service is linked to an SAI service template, you can customize some attributes of the service that are unique to the service.
You can make the following changes to a service without breaking the link to an SAI service template:
- Update KPI thresholds.
- Enable anomaly detection for a KPI.
- Update KPI importance values which contribute to the service health score.
The following changes to a service will break the link to an SAI service template:
- Add a KPI.
- Modify an unlinked KPI (a KPI that does not display a lock icon).
- Modify the name of a linked KPI.
- Modify the base search of a linked KPI (or modifying any other settings in the Search and Calculate section, including enabling backfill).
- Delete a linked KPI.
- Add, modify, or delete entity rules.
Linked KPIs have a lock icon next to the name of the KPI in the KPI tab of the service definition.
If you clone a service that is linked to a template, the clone will also be linked to the service template.
Group alerts from the Splunk App for Infrastructure in ITSI
Create a single ITSI service using an SAI service template
This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.3.0, 4.3.1, 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5, 4.5.0 Cloud only, 4.5.1 Cloud only, 4.6.0 Cloud only, 4.6.1 Cloud only, 4.6.2 Cloud only, 4.7.0, 4.7.1, 4.7.2, 4.7.3, 4.7.4, 4.8.0 Cloud only, 4.8.1 Cloud only, 4.9.0
Feedback submitted, thanks!