Add tags to a service in IT Service Intelligence (ITSI) to provide more context when filtering your services and remediating issues. You can leverage the search bar in the Service Analyzer to filter to a specific subset of services based on the tags those services contain, in addition to the service name and KPI name.
Service tags can serve a variety of functions, including the following examples:
- They eliminate the need to append prefixes to your service titles because you can perform the same filtering actions directly through tagging.
- You can tag services with their team name (
TeamB, and so on) and use it to filter by teams in the Service Analyzer.
- They provide a second layer of filtering in the Service Analyzer beyond services and KPIs. For example, after filtering to your
Web Storeservices, you could include an additional filter for the tag
AMEAto only view web store services in that specific region.
Consider the following rules for adding tags:
- You can't add duplicate tags to a service.
- Tags are case insensitive, meaning you can't add duplicate tags of different cases.
- Tags must be strings and can't contain the following characters: / \ " ' ! @ ? . , ; $ ^
You must have write access to a service to add tags to it. For more information, see ITSI capabilities reference in the Administration Manual.
Perform the following steps to add tags to a service:
- From the ITSI main menu, click Configuration > Services.
- Open the service you want to add tags to.
- Go to the Settings tab.
- Under Tags, add one or more tags to the service. Tags with a lock icon indicate they came from a service template.
- Click Save.
After tagging the services in your environment, go to the Service Analyzer and use the Filter by Tags option to filter on different tags and view the corresponding services and their KPIs. For more information, see Overview of the Service Analyzer in ITSI.
Tags within service templates
When you add tags to a service template, those tags are appended to the existing tags in all linked services when the next template sync happens. Template tags have a lock symbol to indicate they were populated from a template:
If you add or remove tags from a template, they're also added or removed from the linked services. Tags act as soft links between services and templates, so removing or adding a tag to a linked service doesn't unlink it from its template. For a list of actions that do unlink a service from a template, see Link and unlink a service from a service template in ITSI.
Duplicate tags aren't allowed. Therefore, when tags are propagated from a template to its linked service, the tags are deduplicated in favor of those from the template.
When you create a new service template from an existing service, all tags from the service are included in the template. For more information, see Create a service template in ITSI. However, If you create a new service template from a service that's already linked to an existing template, the new template only receives the manually-added tags and not those from the existing template.
If you relink a service from template A to template B, the manually-added service tags are retained, whereas the linked tags from A are replaced with those from B. For more information, see Link a service from one template to another.
Backfill service health scores in ITSI
Overview of the Service Analyzer in ITSI
This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.8.0 Cloud only, 4.8.1 Cloud only, 4.9.0, 4.9.1, 4.9.2, 4.9.3, 4.10.0 Cloud only, 4.10.1 Cloud only, 4.10.2