Splunk IT Service Intelligence
Highlighted

ITSI Bug ? storeentities commands service_fields option does not work

New Member

Dear ITSI dev dept,

these days i work with splunk ITSI v2.0.0 to monitor our network environment
i want to setup a scheduled search with storeentites command to update my entities periodlcally

my search string is looked like:
... | storeentities identifierfields="xxx" informationalfields="yyy" servicefields="zzz" insertionmode=replace

after execute the search , i can see the entities are created with alias and informational fields
but they do not bind to any service.

could u help me to confirm is it a BUG ?
thank u very much

0 Karma
Highlighted

Re: ITSI Bug ? storeentities commands service_fields option does not work

New Member

i have updated ITSI to version v2.1.0
the service_fields option seemed to works correctly , even though it is not stable.

but i meet another issue,
after execute storeentities commands,
i go to the configure>entitites pages , i can see title , alias , services column with context.
then i go to the configure>services pages , the entity rules column of each service is null.
so it means that no entities had bind to any services ?

0 Karma
Highlighted

Re: ITSI Bug ? storeentities commands service_fields option does not work

Splunk Employee
Splunk Employee

Hello vantasy1208,

Can you try adding semicolon delimiters to your search and see if it produces more favorable results?

Additionally, please take a look at this documentation page:

http://docs.splunk.com/Documentation/ITSI/latest/Configure/Aboutthestoreentitiescommand

It lists some guidelines that might help you out.

0 Karma