Create policy to retire entities in ITSI

When an entity stops sending data to Splunk IT Service Intelligence (ITSI), the system still appears as an entity in ITSI until you manually delete the entity. Create an entity lifecycle management policy to identify entities that have not sent data based on your configured criteria. You can then use the results of the entity management policy to selectively retire these entities. Entities identified by the policy are marked with the yellow warning icon on the Entity Management page. Retire entities from ITSI to control the infrastructure components that you want to actively analyze, and improve the performance of your environment. Retired entities will not affect KPI searches.

Entities created manually, imported via one-time bulk import, or imported via recurring import can be marked for retirement. Entities imported with a recurring import that are marked as active or unstable won't be marked as eligible for retirement.

To delete entities that have already been retired, see Delete entities in ITSI.

Prerequisites

Requirement	Description
ITSI roles	You must have the itoa_admin role and have read/write access to the Global team. For more information, see Configure users and roles in ITSI in the Administration Manual.

Steps

Follow these steps to identify the entities that are good candidates for retirement.

Step 1. Create an entity management policy

Create a policy that generates a saved search that evaluate which entities in your environment might be eligible for retirement. When enabled, the policies run a search that evaluates entities in your environment and checks the ITSI metrics summary index itsi_summary_metrics within your configured lookback period to determine whether an entity has recently contributed to KPI or service health scores.

1. From the ITSI main menu, go to Configuration > Entity Management.
2. Select the Entity Management Policies tab and click Create Policy.
3. Configure the following fields:

   Field name	Description
   Policy Title	Enter a unique name per entity policy.
   Retire an entity if it has not sent data in	Retires an entity if the entity has not contributed to a KPI or service health score during a specified time period, and has an N/A or Inactive status.
   Evaluate Entities	Evaluates whether an entity has contributed to a KPI or service health score calculation based on a set recurring schedule. There is a maximum lookback period of 10 days (240 hours).
   Entity Types	(Optional) Filter only for the specific entity types specified in this field. You can only use one entity type per rule, per policy.
   Policy Status	Toggle this setting to enable or disable the policy after creating it. Policies are disabled by default.

4. Click Save. You can enable or disable a policy by toggling the setting under the Status column.

There can only be one policy assigned to a single entity type. You can't create more than one policy for the same entity type, or create more than one policy that evaluates all entities in your system.

Step 2. Retire your entities

The entity management policies you create run a search against the ITSI metrics summary index that checks whether an entity has contributed to a KPI or service health score. Entities that have not contributed data based on the time period specified in your entity management policy are flagged with a yellow warning icon , and these entities are good candidates for retirement.

Retired entities are no longer associated with services or KPIs and are treated as if you deleted them from your system. Any KPIs associated with retired entities display an N/A value on the Service Analyzer. Additionally, retired entities are removed from existing entity rules in your service definitions, and can't be added to new entity rules. When backing up ITSI, retired entities won't be included as part of the backup.

Follow these steps to retire your entities.

1. Select the Entities tab on the Entity Management' page.
2. To delete a single entity, click Edit > Retire Entity from the entity's row. To retire entities in bulk, select the check box to the left of each entity that you want to retire, and then click Bulk Action > Retire selected.
3. (Optional) If you want to retire all entities marked for retirement at once, select the Retire Applicable Entities button. You can retire large numbers of entities with this option. This will retire all entities that are no longer actively sending data, and cannot be cancelled once started.
4. (Optional) You can filter only for entities that are marked for retirement by selecting View > Retirable.

Step 3: View and restore retired entities

When you restore a retired entity, all previous settings are restored and the entity continues to exist in your system. The entity will be added to any associated services and entity rules. Follow these steps to restore previously retired entities, and/or verify that your entities were actually retired.

1. From the ITSI main menu, go to Configuration > Entities.
2. Select the Retired Entities tab to view a list of all entities that were recently retired.
3. (Optional) To restore a retired entity, select the entity you want to restore and click Edit > Unretire.

When an entity previously marked for retirement is restored, the entity will no longer be marked for retirement. However, the entity will be marked for retirement again if it meets the criteria of one of your entity management policies.