Is it possible to export ITSI Services?

theprophet01 — Thu, 04 Apr 2024 14:34:22 GMT

I'm looking to export Service from Splunk ITSI however, there is no direct export feature in the GUI (at least within the Services page). Is there any other way to export ITSI services?

Re: Is it possible to export ITSI Services?

spavin — Fri, 05 Apr 2024 04:42:40 GMT

Hi @theprophet01,

If you have a itoa_admin role, you can export services, entities, glass tables, KPI searches, templates etc from the following menu:

Configuration > Backup/Restore

Click Create Job > Create Backup Job
Select Partial Backup, give it a name and description, uncheck include conf files, then click next
Select the services you'd like to backup
Click Save and Backup
You will be taken to the Backup/Restore jobs page, where your job will be queued. When it's finished, usually after a few minutes, you can download the backup as a zip.
Go to the same page on a different Splunk instance to restore it - this time select Restore Job and upload the zip file.

See the capabilities here: https://docs.splunk.com/Documentation/ITSI/4.18.1/Configure/Capabilities

You'll need the ones listed under "Backup/Restore" which by default is only given to itoa_admin.

Re: Is it possible to export ITSI Services?

theprophet01 — Fri, 05 Apr 2024 11:51:42 GMT

this is perfect, thanks @spavin !

Re: Is it possible to export ITSI Services?

proyleJDS — Mon, 05 Aug 2024 21:42:34 GMT

A search like this will also give you an output that would allow you to practically clone a service tree

Replace <service_title> with the services you want to clone
Replace <info_field> with any service info fields you need to use
Replace <old> and <new> at the end to make new service names
Use the "Create Service" Import from Search option with this search to make a clone of your service tree.

| getservice | search title IN ("<service_title>*","<service_title>*") | fillnull value="none" services_depends_on base_service_template_id | fields title services_depends_on base_service_template_id | rex field=services_depends_on "serviceid=(?<serviceid>.*)~~~" | fillnull value="none" serviceid | mvexpand serviceid | join type=outer serviceid [| `service_kpi_list` | fields serviceid service_name] | stats list(service_name) as dependent_services by title base_service_template_id | eval dependent_services=mvjoin(dependent_services, ",") | rename title as service_name base_service_template_id as template_id | join type=outer template_id [| rest splunk_server=local /servicesNS/nobody/SA-ITOA/itoa_interface/base_service_template report_as=text | eval value=spath(value,"{}") | mvexpand value | eval info_fields=spath(value,"informational.fields{}"), template_id=spath(value, "_key"), template_name=spath(value, "title") | fields template_id template_name] | join type=outer service_name [| inputlookup itsi_entities | fields services._key title | rename services._key as services title as host | mvexpand services | lookup service_kpi_lookup _key as services | stats list(host) as host by title | eval host=mvjoin(host, ",") | rename title as service_name] | makemv delim="," host | mvexpand host | join type=outer host [| rest splunk_server=local /servicesNS/nobody/SA-ITOA/itoa_interface/entity report_as=text | eval value=spath(value,"{}") | mvexpand value | eval info_fields=spath(value,"informational.fields{}"), entity_id=spath(value, "_key"), entity_title=spath(value, "title"), entity_name=spath(value, "identifying_name") | appendpipe [| where isnull(field_type) | mvexpand info_fields | eval field_value = spath(value,info_fields."{}"), field_type="info" | rename info_fields as field_name ] | where field_name IN ("<info_field>","<info_field>","<info_field>","<info_field>") | stats list(field_value) as field_value by field_name entity_name | eval field_value=mvjoin(field_value,",") | eval {field_name}=field_value | stats latest(<info_field>) as <info_field> latest(<info_field>) as <info_field> latest(<info_field>) as <info_field> by entity_name | rename entity_name as host] | fields - template_id | eval service_name=replace(service_name,"<old>","<new>"),dependent_services=replace(dependent_services,"<old>","<new>")

topic Re: Is it possible to export ITSI Services? in Splunk ITSI

Is it possible to export ITSI Services?

Re: Is it possible to export ITSI Services?

Re: Is it possible to export ITSI Services?

Re: Is it possible to export ITSI Services?