Splunk IT Service Intelligence

Bulk change of ITSI service entity rule


I need to change all entity alias value like this:
abxxxx → acxxxx

This makes all services' entity rules unmatched that include the entities.

Re-importing all services isn't good way because it cut links between services and KPI in glass tables.

Is there any good way to change entity rules of paticular services at once?


Splunk Employee
Splunk Employee

If you simply wanted to add an entity rule, I would suggest linking all of the services to a service template that contains this entity rule. Then you could change it whenever you want and it would propagate to all linked services.

Since the entity rule wasn't originally added to the services through a service template, there's no quick way to change it now. I would suggest:

  1. Create a service template containing just the new entity rule (with acxxxx) and link it to all of the services you want to change. (https://docs.splunk.com/Documentation/ITSI/latest/Configure/Linkservicetotemplate)
  2. Go through each service manually and remove the old entity rule (with abxxxx).

That way, in the future if you want to change the entity rule again, you can make that once simple change to the template and it'll propagate to all linked services. It's a best practices to use service templates as much as possible when managing lots of services.


ITSI Version is 3.1.4

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...