topic Splunk IT Service Intelligence: Is there a list of KVstore collection used by ITSI? in Splunk ITSI

Splunk IT Service Intelligence: Is there a list of KVstore collection used by ITSI?

VatsalJagani — Fri, 14 Jun 2019 04:05:26 GMT

I know ITSI is using KVstore to store details like ITSI team, Services, KPIs, templates, Glass Tables, etc.
Is there any list I can get which data ITSI stores in which lookup or KVstore collection?

Bonus question:
Where does ITSI stores KPI data (data-model, kvstore), or it just always search from index data?

Re: Splunk IT Service Intelligence: Is there a list of KVstore collection used by ITSI?

richgalloway — Sun, 16 Jun 2019 14:36:11 GMT

You can get a list of collections used by ITSI with the query

| rest /services/configs/conf-collections | search eai:acl.app="*ITSI*" OR title="*ITSI*" | fields eai:acl.app title

If you have CLI access, btool can also give you a list.

splunk btool --debug collections list | grep -i itsi

KPIs are searches so the data comes from indexes. Search results are stored in the itsi_summary index.

Re: Splunk IT Service Intelligence: Is there a list of KVstore collection used by ITSI?

VatsalJagani — Mon, 17 Jun 2019 13:54:12 GMT

Thanks!!! It gave me the list, but is there any document for ITSI admin to check for troubleshooting by which I can find where ITSI is storing data about services, kpis and glass tables, etc.

Re: Splunk IT Service Intelligence: Is there a list of KVstore collection used by ITSI?

richgalloway — Wed, 19 Jun 2019 11:12:54 GMT

There is no such document. What specific problem are you trying to troubleshoot?

Re: Splunk IT Service Intelligence: Is there a list of KVstore collection used by ITSI?

SamHTexas — Fri, 07 May 2021 14:17:13 GMT

Good day Rich, Thank u for your expert help sir as always. How would I search for a copy of the KVstores on each Splunk server & the KPIs for the sake of backing them up? Thanks