topic Why won't search complete during ITSI Entity import and Service Entity mapping - results show 1 Service and 9K Entities? in Splunk ITSI

Why won't search complete during ITSI Entity import and Service Entity mapping - results show 1 Service and 9K Entities?

Jitu — Mon, 10 Aug 2020 15:48:58 GMT

I was trying to import Service Entities values through an ad-hoc search, however the import never completes. The search results have 1 Service and 9000 Entities associated to this.

I tried a different way of simply uploading the entities alone, the upload completes and then I try to create the service separately. I try to map entities to that service using conditions and it shows me 9000 entities matched and I save it, but again in the entities listed I am not able to see Service tagged to these entities. I did check in the itsi_entities lookup file too. The KPIs for this service don't show up as well for some reason.

Re: ITSI Entity import and Service Entity mapping

eduncan — Mon, 10 Aug 2020 15:08:40 GMT

Are there really 9,000 unique entities that are related to a service? Make sure that in your adhoc search you are deduping on the host name or entity title name. If you want to manually add them from a csv, you need to have a field that designates the service they are supposed to be related to. Best practice is to use something in the actual data of the entity that shows they should be part of a service and NOT a host name because then it is not dynamic. If you are importing via a search and you have a large number of entities that already exist, it may fail because it is trying to update existing ones. 9K entities is a large number so make sure you are deduping in your ad hoc search.