Splunk IT Service Intelligence

Enabling access to ITSI Entity Details page

rdimar
New Member

We have a fresh ITSI install and have configured the OS Module requirments to serveral Windows and Unix hosts. Data is coming back for all servers. We have defined Services based on the Entities (host) and default OS Module KPIs. However, when we want to view the OS Host Details, we could not get the link to bring it up as described here.
ITSI Access Entity Details
http://docs.splunk.com/Documentation/ITSI/2.5.2/IModules/ITSIModuleFeatures#Access_Entity_Details_pa...

Instead of OS Host Details we are getting the message - Failed to retrieve entity rules due to some errror, see console for details.

alt text

Note that I have enabled overlays for each of the swim lanes.

Also, this may be related. In the Entity Details from Service Details page, Modules list is empty. See below.
alt text

What should i be checking?
thanks

0 Karma

anilchaithu
Builder

The entity data is enriched with tags (tag=inventory tag=oshost). If you miss the tag=inventory, the oshost module link won't appear.

0 Karma

hdbang_splunk
Splunk Employee
Splunk Employee

ITSI modules have deep_dive_drilldowns.conf with entity_activation_rules for the links.
For example, OS Modules has below configuration.

cat ./apps/DA-ITSI-OS/default/deep_dive_drilldowns.conf
[OS Host Details]
type = uri
replace_tokens = true
kpi_lane_enabled = true
entity_level_only = true
entity_activation_rules = [ \
{ \
"rule_condition": "AND", \
"rule_items": [ \
{ \
"field": "host", \
"field_type": "alias", \
"rule_type": "not", \
"value": "" \
}, \
{ \
"field": "itsi_role", \
"field_type": "info", \
"rule_type": "matches", \
"value": "operating_system_host" \
} \
] \
} \
]
::
According to the rule in deep_dive_drilldowns.conf, 'host' field can be empty but 'itsi_role' should be "operating_system_host" in order to activate "OS Host Details" link.
If you add info Fields 'itsi_role' with 'operating_system_host' into entity rule, the link "OS Host Details" will come back.

0 Karma

ntankersley_spl
Splunk Employee
Splunk Employee

I think the first thing to check is the console. You have the right role enabled so I think there may be an issue in retrieving the entity rules for setting that link.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...