Splunk IT Service Intelligence

Can ITSI Maintenance mode be set from a command line as opposed to via the GUI and if so, how?


I'm lazy and a creature of habit. I do a regular weekly maintenance on our Splunk systems which necessitates setting up a bunch of maintenance windows in ITSI in advance via the GUI.

Is there a way to create an ITSI maintenance window from a command line / rest call - basically so I can set it up in CRON and get another 30 mins in bed?

All I need is to be able to specify:

  1. Which server
  2. A name for the window
  3. A Duration
  4. List of impacted services or entities
1 Solution

Splunk Employee
Splunk Employee
0 Karma


Use the below CURL to put Entities in Maintenance mode.

Time should be in UTC.
Use _key id for entities.

curl -k -u admin:password https://localhost:8089/servicesNS/nobody/SA-ITOA/maintenance_services_interface/maintenance_calendar -X POST -H "Content-Type:application/json" -d '{"title":"TEST MW","start_time":1589705600,"end_time":1589709600,"objects":[{"object_type":"entity","_key":"52f345bd-9764-4bc1-82a1-040"},{"object_type":"entity","_key":"45de7c5f-0d5f-4d50-9910-a1a"}]}'

Path Finder

Slight alteration - I had to add underscores in the start_time, end_time, object_type and _key to get this to work:

curl -k -u username:password https://localhost:8089/servicesNS/nobody/SA-ITOA/maintenance_services_interface/maintenance_calendar -X POST -H "Content-Type:application/json" -d "{\"title\":\"TEST MW\",\"start_time\":1589705600,\"end_time\":1589709600,\"objects\":[{\"object_type\":\"entity\",\"_key\":\"10bc6ede-20f5-45a8-a19f-562ffc425f69\"}]}"

0 Karma

Splunk Employee
Splunk Employee
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...