Splunk IT Service Intelligence

Deletion of ITSI entities and Services-If I delete the services directly , does it remove all the associated entities ?

Path Finder

Hi All,

I want to delete few services and its entities from splunk ITSI search head. If I delete the services directly , does it remove all the associated entities ? 


Labels (1)
0 Karma

Splunk Employee
Splunk Employee

No deleting service in ITSI does not affect the entities. In your case I would: 
* identify what filters are used to filter entities to the services you are to delete.
* Use the entity management view to verify if these entities used in any other services? If yes, do you really want to delete them? If no select and delete them from the entity management UI. Preferably before deleting the service so you can verify in the service that the entities now are gone. 

Also note that if these entities and or services are created by a scheduled job, they might reappear when those jobs are run again. 


0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...