topic Re: ITSI install on Splunk enterprise in Splunk Enterprise

ITSI install on Splunk enterprise

Xiaorq — Mon, 14 Apr 2025 02:23:09 GMT

Dear Team,

We have obtained the ITSI installation package "splunk-it-service-intelligence-4193. spl" and installed it according to the installation guide on the official website“ https://docs.splunk.com/Documentation/ITSI/4.20.0/Install/Install ”.

In the end, the Splunk Enterprise platform only has the ITEM app. What is the reason for this? Please provide technical support.

Thank you.

Re: ITSI install on Splunk enterprise

livehybrid — Mon, 14 Apr 2025 20:52:18 GMT

Hi @Xiaorq

Just to check is it IT Essentials Work (ITEW) that you see installed?

If you install ITSI but do not apply the ITSI License to your environment then I believe it reverts to ITEW (see https://splunk.my.site.com/customer/s/article/ITSI-app-reverted-to-IT-Essential-Work-IT-W-and-does-not-show-premium-features)

Please can you confirm if you have installed your ITSI specific license? The install location depends on your environment configuration/architecture - please see https://docs.splunk.com/Documentation/ITSI/4.20.0/Install/InstallDD for more info.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: ITSI install on Splunk enterprise

Xiaorq — Tue, 15 Apr 2025 01:51:56 GMT

2025-04-14 21:48:49,293 INFO [root] [itsi_license_checker] [do_run] Modular input is starting...

2025-04-14 21:48:49,551 INFO [itsi.license_checker.SplunkLicensesAPI] [splunk_licenses_api] [is_license_dependent] Checking is license dependent : License manager uri : self :

2025-04-14 21:48:49,551 INFO [root] [itsi_license_checker] [do_run] Modular input is running...

2025-04-14 21:48:49,558 INFO [itsi.license_checker.ItsiInternalLicensesGroupFactory] [itsi_internal_licenses_group_factory] [_get_active_subgroup] Active license group: Enterprise

2025-04-14 21:48:49,638 INFO [itsi.license_checker.ItsiInternalLicensesGroupFactory] [itsi_internal_licenses_group_factory] [_get_active_subgroup] Non ITSI internal licenses in active group: [<license.License object at 0x7f3317aa22e0>]

2025-04-14 21:48:49,639 INFO [itsi.license_checker.ItsiInternalLicensesGroupFactory] [itsi_internal_licenses_group_factory] [get_license_group] Active subgroup: Production

2025-04-14 21:48:49,647 INFO [itsi.license_checker.LicenseManager] [license_manager] [manage_license_expiration_signaling_license] No real ITSI license is installed

2025-04-14 21:48:49,647 INFO [root] [itsi_license_checker] [do_run] Modular input completed successfully

2025-04-14 21:48:49,647 INFO [root] [modular_input] [execute] Modular input: itsi_license_checker exit normally.

2025-04-14 21:49:49,277 INFO [root] [itsi_license_checker] [do_run] Modular input is starting...

2025-04-14 21:49:49,531 INFO [itsi.license_checker.SplunkLicensesAPI] [splunk_licenses_api] [is_license_dependent] Checking is license dependent : License manager uri : self :

2025-04-14 21:49:49,531 INFO [root] [itsi_license_checker] [do_run] Modular input is running...

2025-04-14 21:49:49,538 INFO [itsi.license_checker.ItsiInternalLicensesGroupFactory] [itsi_internal_licenses_group_factory] [_get_active_subgroup] Active license group: Enterprise

2025-04-14 21:49:49,618 INFO [itsi.license_checker.ItsiInternalLicensesGroupFactory] [itsi_internal_licenses_group_factory] [_get_active_subgroup] Non ITSI internal licenses in active group: [<license.License object at 0x7f57146e22e0>]

2025-04-14 21:49:49,618 INFO [itsi.license_checker.ItsiInternalLicensesGroupFactory] [itsi_internal_licenses_group_factory] [get_license_group] Active subgroup: Production

2025-04-14 21:49:49,626 INFO [itsi.license_checker.LicenseManager] [license_manager] [manage_license_expiration_signaling_license] No real ITSI license is installed

2025-04-14 21:49:49,626 INFO [root] [itsi_license_checker] [do_run] Modular input completed successfully

2025-04-14 21:49:49,626 INFO [root] [modular_input] [execute] Modular input: itsi_license_checker exit normally.

Splunk Enterprise Sales Trial 307,200 MB 2025年5月22日上午2:59:59 有效

IT Service Intelligence Internals *DO NOT COPY* 102,400,000 MB 2038年1月18日下午10:14:07 有效

The above informations are logs and licenses. Please help confirm: Can the ITSI run normally?

Thank you.

Re: ITSI install on Splunk enterprise

Xiaorq — Tue, 15 Apr 2025 01:54:12 GMT

2025-04-14 21:48:49,293 INFO [root] [itsi_license_checker] [do_run] Modular input is starting... 2025-04-14 21:48:49,551 INFO [itsi.license_checker.SplunkLicensesAPI] [splunk_licenses_api] [is_license_dependent] Checking is license dependent : License manager uri : self : 2025-04-14 21:48:49,551 INFO [root] [itsi_license_checker] [do_run] Modular input is running... 2025-04-14 21:48:49,558 INFO [itsi.license_checker.ItsiInternalLicensesGroupFactory] [itsi_internal_licenses_group_factory] [_get_active_subgroup] Active license group: Enterprise 2025-04-14 21:48:49,638 INFO [itsi.license_checker.ItsiInternalLicensesGroupFactory] [itsi_internal_licenses_group_factory] [_get_active_subgroup] Non ITSI internal licenses in active group: [<license.License object at 0x7f3317aa22e0>] 2025-04-14 21:48:49,639 INFO [itsi.license_checker.ItsiInternalLicensesGroupFactory] [itsi_internal_licenses_group_factory] [get_license_group] Active subgroup: Production 2025-04-14 21:48:49,647 INFO [itsi.license_checker.LicenseManager] [license_manager] [manage_license_expiration_signaling_license] No real ITSI license is installed 2025-04-14 21:48:49,647 INFO [root] [itsi_license_checker] [do_run] Modular input completed successfully 2025-04-14 21:48:49,647 INFO [root] [modular_input] [execute] Modular input: itsi_license_checker exit normally. 2025-04-14 21:49:49,277 INFO [root] [itsi_license_checker] [do_run] Modular input is starting... Splunk Enterprise Sales Trial 307,200 MB 2025年5月22日上午2:59:59 有效 IT Service Intelligence Internals *DO NOT COPY* 102,400,000 MB 2038年1月18日下午10:14:07 有效 The above informations are logs and licenses. Please help confirm: Can the ITSI run normally? Thank you.

Re: ITSI install on Splunk enterprise

livehybrid — Tue, 15 Apr 2025 08:05:01 GMT

Hi @Xiaorq

It looks like you have a regular ingest license, plus the ITSI Internal license (this is for sourcetype=itsi_* - Used for internal ITSI metadata etc) however it doesnt look like you have the actual ITSI License which unlocks ITSI to be used. I see you are on a Sales Trial license - did the sales team provide you an additional ITSI license? I would recommend reaching out to them to check they've given you the correct license(s) to run ITSI.

Check out https://www.youtube.com/watch?v=SUQpN8Re66g which might help too.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: ITSI install on Splunk enterprise

isoutamo — Tue, 15 Apr 2025 20:36:06 GMT

Actually ITSI and IT Essential Work are same product (only one download package). The only difference is that ITSI needs official license to enable those additional features. You could say that ITEW is just sales tool for ITSI 😉