Splunk IT Service Intelligence

How to extract the entities in a service as a lookup in ITSI

raynold_peterso
Path Finder

I have been wracking my poor brain on how to extract the entities from my services in ITSI.

Here is what I want to do. I want to use my configured services and entities to create a lookup to drive my kpi adhoc searches so when and if I have to update the entities in the service the associated searches will pull the correct entities.

I may be trying to go about this the wrong way, so it you have a better suggestion then I am open for new ideas.

Thanks in advance,
Rcp

0 Karma

raynold_peterso
Path Finder

Something like that. I want to know what entities are in the service so I can create an adhoc job for the kpi on just those entities. From a lookup table would be ok but I'd rather have the kdi read the data directly from the configuration. That way if I add or remove entities the kpi automatically adjusts.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Are you wanting to extract the entity names? I'm assuming you want to extract the entity names and write them to a lookup table?

0 Karma

ronvreeken
Explorer

Is this what you ar looking for ?

| inputlookup itsi_entities append=true
| rename services._key as service_key
| rename title as entity
| fields entity, service_key
| where isnotnull(service_key)
| mvexpand service_key
| inputlookup service_kpi_lookup append=true
| eval key=coalesce(service_key,_key)
| stats values(entity) as entity, values(title) as service by key
| mvexpand entity
| fields entity service
| sort 0 entity
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...