Splunk IT Service Intelligence

ITSI Bug ? storeentities commands service_fields option does not work

New Member

Dear ITSI dev dept,

these days i work with splunk ITSI v2.0.0 to monitor our network environment
i want to setup a scheduled search with storeentites command to update my entities periodlcally

my search string is looked like:
... | storeentities identifier_fields="xxx" informational_fields="yyy" service_fields="zzz" insertion_mode=replace

after execute the search , i can see the entities are created with alias and informational fields
but they do not bind to any service.

could u help me to confirm is it a BUG ?
thank u very much

0 Karma

Splunk Employee
Splunk Employee

Hello vantasy1208,

Can you try adding semicolon delimiters to your search and see if it produces more favorable results?

Additionally, please take a look at this documentation page:


It lists some guidelines that might help you out.

0 Karma

New Member

i have updated ITSI to version v2.1.0
the service_fields option seemed to works correctly , even though it is not stable.

but i meet another issue,
after execute storeentities commands,
i go to the configure>entitites pages , i can see title , alias , services column with context.
then i go to the configure>services pages , the entity rules column of each service is null.
so it means that no entities had bind to any services ?

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...