Splunk® Content Packs for ITSI and IT Essentials Work

Splunk Content Packs for ITSI and IT Essentials Work

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Migrate from the Content Pack for Splunk Synthetic Monitoring to the Content Pack for Splunk Observability Cloud

The Content Pack for Splunk Synthetic Monitoring was replaced by the Content Pack for Splunk Observability Cloud in version 1.4.0 of the Splunk App for Content Packs. If you were using the Content Pack for Splunk Synthetic Monitoring follow these steps to migrate to the Content Pack for Splunk Observability Cloud.

Prerequisite

Create a full backup of your ITSI environment. For more information, see Create a full backup in the Administration Manual.

Step 1: Disable the content pack app

  1. Go to Apps > Manage Apps
  2. Search for "Splunk Synthetics".
  3. Locate Folder Name: DA-ITSI-CP-splunk-synthetics and select Disable under Status.

Step 2: Remove Splunk Synthetic Monitoring entity search

  1. Go to Settings > Searches, reports, and alerts.
  2. Filter by App: IT Service Intelligence (itsi) and Owner: All.
  3. Search for "ITSI Import Objects".
  4. Locate your Splunk Synthetic Monitoring entity search: ITSI Import Objects - Get_SSM_Entities.
  5. Select Edit > Delete.

Step 3: Remove Content Pack for Splunk Synthetic Monitoring objects

There are two options to remove the content pack objects:

  1. Remove through the ITSI user interface.
  2. Use REST API calls. This approach is faster.

Option 1: Remove the Content Pack for Splunk Synthetic Monitoring objects through the ITSI user interface

Step 1: Remove the Content Pack for Splunk Synthetic Monitoring entities

  1. From the ITSI menu go to Configuration > Entities.
  2. Under Advanced Filter create this filter rule: Service Title: "*Synthetic Checks*"
  3. Select all entities and select Bulk Action > Delete selected.

The list of entities is paginated. Be sure to delete all entities.

Step 2: Remove the Content Pack for Splunk Synthetic Monitoring entity types

  1. From the ITSI menu go to Configuration > Entities.
  2. Go to the Entity Type tab.
  3. For each of these entity types, select Edit > Delete.
    • Synthetic API
    • Synthetic Benchmark
    • Synthetic Content
    • Synthetic HTTP
    • Synthetic Real Browser

Step 3: Remove the Content Pack for Splunk Synthetic Monitoring services

  1. From the ITSI menu go to Configuration > Services.
  2. Search for "Synthetic".
  3. Select Edit > Delete for each of these services and any others you might have created:
    • All API Synthetic Checks
    • All Benchmark Synthetic Checks
    • All Content Synthetic Checks
    • All HTTP Synthetic Checks
    • All Real Browser Synthetic Checks
    • All Splunk Synthetic Monitoring Checks
    • Splunk Synthetic Monitoring Check Template - (start here)

Step 4: Remove the Content Pack for Splunk Synthetic Monitoring KPI base searches

  1. From the ITSI menu go to Configuration > KPI Base Searches.
  2. Search for "SSM".
  3. Select Edit > Delete for each of these KPI base searches and any others you might have created:
    • SSM_api_checks
    • SSM_benchmark_checks
    • SSM_content_checks
    • SSM_http_checks
    • SSM_real_browser_checks

Option 2: Use REST API calls to remove the Content Pack for Splunk Synthetic Monitoring objects

If you have a lot of entities, deleting objects via the API is faster.

For each REST API call, use GET to verify only the desired objects are returned for the Content Pack for Splunk Synthetic Monitoring. The REST API calls should be made in order. For information on the Splunk ITSI REST API, see the ITSI REST API Reference manual.

  1. Verify the Content Pack for Splunk Synthetic Monitoring entities.
    curl -k -u admin:password -X GET 'https://<Splunk server>:8089/servicesNS/nobody/SA-ITOA/itoa_interface/entity/?fields=title,entity_type_ids&filter={"entity_type_ids":{"$regex":"da-itsi-cp-splunk-synthetics.*"}}'
  2. Remove the Content Pack for Splunk Synthetic Monitoring entities.
    curl -k -u admin:password -X DELETE 'https://<Splunk server>:8089/servicesNS/nobody/SA-ITOA/itoa_interface/entity/?filter={"entity_type_ids":{"$regex":"da-itsi-cp-splunk-synthetics.*"}}'
  3. Verify the Content Pack for Splunk Synthetic Monitoring entity type.
    curl -k -u admin:password -X GET 'https://<Splunk server>:8089/servicesNS/nobody/SA-ITOA/storage/collections/data/itsi_entity_type?query={"source_itsi_da":"DA-ITSI-CP-splunk-synthetics"}'
  4. Remove the Content Pack for Splunk Synthetic Monitoring entity type.
    curl -k -u admin:password -X DELETE 'https://<Splunk server>:8089/servicesNS/nobody/SA-ITOA/storage/collections/data/itsi_entity_type?query={"source_itsi_da":"DA-ITSI-CP-splunk-synthetics"}'
  5. Verify the Content Pack for Splunk Synthetic Monitoring services, KPIs and KPI base searches.
    curl -k -u admin:password -X GET 'https://<Splunk server>:8089/servicesNS/nobody/SA-ITOA/storage/collections/data/itsi_services?query={"source_itsi_da":"DA-ITSI-CP-splunk-synthetics"}'
  6. Remove the Content Pack for Splunk Synthetic Monitoring services, KPIs and KPI base searches.
    curl -k -u admin:password -X DELETE 'https://<Splunk server>:8089/servicesNS/nobody/SA-ITOA/storage/collections/data/itsi_services?query={"source_itsi_da":"DA-ITSI-CP-splunk-synthetics"}'

Step 4: Install the Content Pack for Splunk Observability Cloud

Once you have deleted all the objects from the Content Pack for Splunk Synthetic Monitoring, you can install the Content Pack for Observability Cloud. See the Install and configure the Content Pack for Splunk Observability Cloud topic for installation steps.

Last modified on 27 October, 2021
PREVIOUS
Migrate from the Content Pack for Splunk Infrastructure Monitoring to the Content Pack for Splunk Observability Cloud
  NEXT
Troubleshoot the Content Pack for Observability Cloud

This documentation applies to the following versions of Splunk® Content Packs for ITSI and IT Essentials Work: current


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters