Splunk® IT Service Intelligence

Service Insights Manual

Link and unlink services from service templates in ITSI

Link multiple services to a service template to manage them collectively in IT Service Intelligence (ITSI). A service can only be linked to one service template at a time. When you link a service to a service template, any existing KPIs in the service are preserved and KPIs in the template are added to the service. You can choose to append, replace, or keep entity rules.

There's no limit to the number of services that can be linked to a service template at one time. However, the higher the number of services linked to a service template, the longer it takes to update it.

If your service isn't created yet, you can generate it directly from the service template rather than manually creating and linking it. For more information, see Create a service from a service template in ITSI.

Prerequisites

  • You must have the write_itsi_service capability to link a service to a service template. The itoa_admin and itoa_team_admin roles have this capability by default.
  • At least one service template must exist in ITSI.

Steps

  1. Click Configuration then Service Monitoring then Service and KPI Management from the ITSI main menu.
  2. In the Actions column for the service you want to link, click Edit then Link to Service Template.
  3. Click Select... and choose a template. If the service is already linked to a template, choose a different template to link the service to.
  4. In the template details section, review the entity rules, the KPIs that are contained in the template, and the services already linked to the template.

    When linking a service to a template for the first time, any KPIs that already exist are retained and new KPIs from the template are added. If any KPIs in the service have the same name as a KPI in the template, the KPI in the service is renamed using a unique identifier.

  5. In the Settings section, choose how to update the entity rules in the service:
    Setting Description
    Append template rules Adds the entity rules from the template to the service and keeps the ones that were already there.
    Replace with template rule Deletes the existing entity rules in the service and replaces them with the entity rules from the service template.
    Keep existing service rules Keeps the existing entity rules in the service and does not add any entity rules from the template.
  6. Click Link. The Service Template column indicates that the service is synced with the service template.

Review and customize the service

After linking a service to a template, or changing the template a service is linked to, review the content updates the service received from the template. You can also customize the service to meet your needs.

Review the following tabs within the linked service:

KPIs

Note the following KPI changes when you link a service to a template:

    • All KPIs added from the template display a lock icon Lock.png to indicate that they're linked. KPIs that already existed in the service don't have a lock icon so changes to the template don't affect them.
    • Any service KPIs with the same name as a template KPI are renamed with _custom and a unique identifier appended to the KPI name.

You can set custom thresholds for any linked KPIs. If you change the threshold settings, or if the adaptive thresholding value is recalculated, a Unlockicon.png icon appears in the Thresholding section but the service is still linked. To preserve custom thresholds when you update a template, select Overwrite KPI Thresholds on: All Unchanged KPIs.

Making any other changes to a linked KPI, such as changing the name of the KPI, changing the base search it uses, or enabling backfill, unlinks the service from the template.

Entities

Note the following entity changes when you link a service to a template:

    • If you selected Append template rules when you linked the service to the template, the entity rules from the template are added to a new rule block with an implicit OR between the rule blocks.
    • If you selected Replace with template rules when you linked the service to the template, any entity rules that were in the service are gone and the entity rules from the service template are added.
    • If you selected Keep existing service rules when you linked the service to the template, the existing entity rules in the service are listed and no new entity rules are added from the template.

Any entity rules with blank values that came from the template contain a Blank entity value.png icon. Provide a value to filter the service to a specific set of entities. Some entity rules might have blank values intentionally and don't display the icon. For more information, see Add entity rules to a service in ITSI.

You can add or change any entity rules. If you update the service template in the future, you can choose to preserve these customized entity rules. For more information, see Update a service template in ITSI.

Service Dependencies

Specify any service dependencies. Service dependencies, or impacting services, have some sort of effect or influence on the primary service. For more information, see Add service dependencies in ITSI.

Settings

Custom KPI importance values for a service, which are used to determine the service health score, can be preserved when the service template is updated. For more information, see Set KPI importance values in ITSI.

Link a service from one template to another

You can directly link a service from one template to another. Manually-added KPIs and service tags are retained while linked KPIs and tags from the original template are replaced with those from the new template.

  1. From the ITSI main menu, click Configuration > Service Templates.
  2. Open the service template.
  3. Go to the Linked Services tab.
  4. Click Edit > Link to another Service Template.
  5. Choose a template to link to and click Link.

Bulk import services and link them to a template

When you bulk import services, you can automatically link them to an existing service template so the KPIs and entity rules are populated for you. You can also link existing services to service templates in bulk. For an example of linking services to templates in bulk, see Import services from a CSV in ITSI.

For example, the director of IT might ask you to create Apache services for every Apache instance in the company. There are dozens of instances and you realize you cannot do this manually, so you use the existing Apache service template with a configurable entity rule to filter entities by a different value for each linked service.

Unlink a service from a template

Linked KPIs in IT Service Intelligence (ITSI) have a lock icon Lock.png next to the name of the KPI. There's no direct method to unlink a service from a template. You can only unlink a service by performing one of the following actions:

  • Deleting the service template
  • Linking the service to a different service template
  • Modifying the name of a linked KPI
  • Modifying the base search of a linked KPI
  • Modifying any settings in the KPI Search and Calculate section, including enabling backfill
  • Deleting a KPI that's linked to the template
  • Drilling down on numbers in the Linked Services column and deleting the linked service

After you unlink a service, it retains any manually-added KPIs and service tags.

Next steps

The next time you update the template, any changes you make are propagated to all linked services. For more information about updating a service template, see Update a service template in ITSI.

Last modified on 30 April, 2024
Create a service from a service template in ITSI   Update a service template in ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.19.0, 4.19.1


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters