Splunk IT Service Intelligence

How data gets populated in ITSI ?


Hi All,

I have ingested some sample logs in ITSI from windows, oracledb, aws, netapp devices, but the dashboards are not getting populated in ITSI.
Can can anyone who knows ITSI suggest or guide, how can the search ananlyzer, dashboards gets populated ?
I have enabled correlation searches as well, but it did not worked.

Labels (1)
0 Karma

Splunk Employee
Splunk Employee

in ITSI 

The search analyzer get populated by the summarized KPI data. (from index=itsi_summary in older versions, from metric index=itsi_summary_metrics since ITSI 4.7)

To get data in it this requires those steps :

- define some entities (optional, but nicer), if you have normalized data from official addons, you could look to enable the default entity detections (they can pick up linux metrics, windows entities, databases etc)
- create services (with filters to find entities if you are using entities), and some KPIs. If you are using normalized data, you can look at the "shared base searches" examples shipped to create your KPIs.
- the KPI are working like scheduled saved searches, they will start to summarize your metrics, and save the result into the indexes
- then the service analyzer will have data to measure the services healthscores, and will start populate.

for details  on the service insight : https://docs.splunk.com/Documentation/ITSI/4.9.2/SI/AboutSI

The other feature in ITSI is to use Alerting / Episodes
To get it setup

- create correlation searches, generating notable events (going to the index=itsi_tracked_alerts)
- OR if you have KPIs, use multiKPI alerting
- the Rules engine will detect them in realtime (you need realtime allowed), and group them in to episodes in to index=itsi_grouped_alerts
- the episodes will be displayed in the "incident review" dashboard

for details on "Event Analytics" https://docs.splunk.com/Documentation/ITSI/4.9.2/EA/AboutEA

for ITSI to work, please double check that :
- you have realtime allowed
- that JAVA is installed on the SH
- that the SA-IndexCreation app was properly deployed on the indexers 
 - that your ITSI SH is able to forward data to the indexers
- that HEC is enabled and working on the SH

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...