Overview of creating an ITSI service using an SAI service template

An ITSI service is a representation of a real-world IT service that lets you monitor the health of IT systems and business processes. Use an SAI service template to create an ITSI service from Splunk App for Infrastructure (SAI) entities. The template populates the service with pre-built KPIs and entity rules as defined in the service template.

For instructions on creating a service using SAI entities, see Create a single ITSI service using an SAI service template.

SAI service templates

ITSI ships with four predefined SAI service templates that are based on the operating system of your Splunk deployment. Use these templates to create services from Splunk App for Infrastructure entities. The SAI service template populates the service with pre-built KPIs and entity rules. KPI thresholds are configured by default, while entity rules require some configuration while you're creating the service.

The following table describes the supported operating systems and KPIs in each service template.

SAI service template	Supported OS type	KPIs contained in the template
Cloud KPIs - AWS EBS (SAI)	AWS EBS deployment type displays as VolumeId	AWS/EBS Burst Balance AWS/EBS Queue Length AWS/EBS Volume Idle Time AWS/EBS Volume Total I/O MB AWS/EBS Volume Total I/O Time AWS/EBS Volume Total Operations
Cloud KPIs - AWS EC2 (SAI)	AWS EC2 deployment type displays as InstanceId	AWS/EC2 CPU Utilization AWS/EC2 Disk Total I/O MB AWS/EC2 Disk Total I/O Operations AWS/EC2 Network Total I/O MB AWS/EC2 Network Total Packets AWS/EC2 Status Checks Failed
OS KPIs - *nix (SAI)	Supported *nix distributions include: CentOS Debian Fedora Mac OS X Red Hat Solaris SUSE Ubuntu	CPU Active % Disk IO Weighted Time Disk Queue - Pending Operations IO Wait % Load Ave - 1 minute Load Ave - 15 minute Load Ave - 5 minute Network Bandwidth MB/s Network Errors Network Packet Drop % Storage Used %
OS KPIs - Windows (SAI)	Supported Windows versions include: Microsoft Windows Server 2012 Microsoft Windows 10	% Disk I/O Time  % Free Disk Space  % Memory Committed in Use Network I/O MBs Network I/O Packets per Second Processor Active Time % Processor Queue Length

SAI service templates do not support creating services with AWS ELB deployments. You must create and configure a single service manually.

Entity rules for SAI service templates when creating ITSI services

When creating an ITSI service using an SAI service template, you must configure entity rules to filter the SAI entities to the service. Enter SAI group dimensions (group filters) as entity rules when creating a service, enabling the dimensions to act as the filters to match the entities to the service. See the Example of entity rules defined in an SAI service template.

SAI service template	Enter the dimension value(s) to complete the entity rule
Cloud KPIs - AWS EBS (SAI)	Info itsi_role matches SAI Alias VolumeId matches * Info region matches <value to be defined in the service> Add all additional group dimensions as Info entity rules
Cloud KPIs - AWS EC2 (SAI)	Info itsi_role matches SAI Alias InstanceId matches * Info region matches a <value to be defined in the service> Add all additional group dimensions as Info entity rules
OS KPIs - *nix (SAI)	Info itsi_role matches SAI Info os does not match Microsoft* Alias host matches CHANGEME Add all additional group dimensions as Info entity rules Note: You can include more than one *nix OS type dimension in the entity rule. For example, centos and ubuntu.
OS KPIs - Windows (SAI)	Info itsi_role matches SAI Info entity_type matches Windows_Host Info os matches Microsoft* Alias host matches CHANGEME Add all additional group dimensions as Info entity rules

Define entity rules when using an SAI service template to create a service

In this example, you want to create a new ITSI service for the entities contained in an SAI group. In order to do this, you use an SAI service template to create the service. Now you need to define entity rules to filter the service to the entities in the SAI group.

For this example, you have created a new service in ITSI named "Server Group - Staging", that mirrors an SAI group named "Server Group - Staging". You must define the entity rules in the new service to match the SAI group filter dimensions. By matching the entity rules with the SAI group filter dimensions, SAI entities that have been ingested into ITSI map to the new service and mirror the SAI group.

1. In ITSI, after you create the new service called "Server Group - Staging" using the "OS KPIs - *nix (SAI)" service template, the service is populated with default entity rules as defined in the template, as shown in the following example.
   The Info itsi_role matches SAI entry is a required entity rule for the service; do not remove it. You can edit the field values for the other default entity rules, and you can add more rules based on the dimensions of the SAI group.
   
   
2. In SAI, find the group and group filter dimensions as shown in the following image. Note the group filter dimensions so you can add them as entity rules in the new service in ITSI.
   
3. In ITSI, enter the SAI group filter dimensions as entity rules in the new service, replacing default entity rule values and adding any additional group filter dimensions as entity rules. The matching entities in ITSI are displayed. Make sure that these entities match the entities contained in the SAI group.
4. Click Save.

Summary of changes that unlink a service from an SAI service template

When a service is linked to an SAI service template, you can customize some attributes of the service that are unique to the service.

You can make the following changes to a service without breaking the link to an SAI service template:

• Update KPI thresholds.
• Enable anomaly detection for a KPI.
• Update KPI importance values which contribute to the service health score.

The following changes to a service will break the link to an SAI service template:

• Add a KPI.
• Modify an unlinked KPI (a KPI that does not display a lock icon).
• Modify the name of a linked KPI.
• Modify the base search of a linked KPI (or modifying any other settings in the Search and Calculate section, including enabling backfill).
• Delete a linked KPI.
• Add, modify, or delete entity rules.

Linked KPIs have a lock icon next to the name of the KPI in the KPI tab of the service definition.

If you clone a service that is linked to a template, the clone will also be linked to the service template.