Splunk IT Service Intelligence

Can ITSI Maintenance mode be set from a command line as opposed to via the GUI and if so, how?

Engager

I'm lazy and a creature of habit. I do a regular weekly maintenance on our Splunk systems which necessitates setting up a bunch of maintenance windows in ITSI in advance via the GUI.

Is there a way to create an ITSI maintenance window from a command line / rest call - basically so I can set it up in CRON and get another 30 mins in bed?

All I need is to be able to specify:

  1. Which server
  2. A name for the window
  3. A Duration
  4. List of impacted services or entities
1 Solution

Splunk Employee
Splunk Employee
0 Karma

Engager

Use the below CURL to put Entities in Maintenance mode.

Time should be in UTC.
Use _key id for entities.

curl -k -u admin:password https://localhost:8089/servicesNS/nobody/SA-ITOA/maintenance_services_interface/maintenance_calendar -X POST -H "Content-Type:application/json" -d '{"title":"TEST MW","start_time":1589705600,"end_time":1589709600,"objects":[{"object_type":"entity","_key":"52f345bd-9764-4bc1-82a1-040"},{"object_type":"entity","_key":"45de7c5f-0d5f-4d50-9910-a1a"}]}'

Path Finder

Slight alteration - I had to add underscores in the start_time, end_time, object_type and _key to get this to work:

curl -k -u username:password https://localhost:8089/servicesNS/nobody/SA-ITOA/maintenance_services_interface/maintenance_calendar -X POST -H "Content-Type:application/json" -d "{\"title\":\"TEST MW\",\"start_time\":1589705600,\"end_time\":1589709600,\"objects\":[{\"object_type\":\"entity\",\"_key\":\"10bc6ede-20f5-45a8-a19f-562ffc425f69\"}]}"

0 Karma

Splunk Employee
Splunk Employee
0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!