Splunk IT Service Intelligence

ITSI Service Template Sync Schedule

ewan000
Path Finder

I have several service templates which are in the status of "Sync Scheduled" I've left them some time with no change.

What trouble shooting steps can I take? ie.

How can I find out when they are scheduled to sync?
How can I force a sync?
How can I see any sync errors? ( think I know this, but for completeness...)
What are the common causes of service templates not syncing promptly?
What is the expected time to wait before they sync?

Labels (2)
0 Karma

ehqtrainorm
Explorer

Hey mate,

 

I can't address your other questions, but I also wondered what the schedule was for syncing service templates.

In SA-ITOA/default/inputs.conf there is a stanza:

[itsi_service_template_update_scheduler://itsi_service_template_update_scheduler]
interval = 900
disabled = 0

 

If you look in SA-ITOA/bin you will find itsi_service_template_update_scheduler.py. This is the modular input script invoked by the scheduled input.

 

You can check the log by running the SPL:

index=_internal source="*itsi_service_template_update_scheduler*"

esnyder_splunk
Splunk Employee
Splunk Employee
How can I find out when they are scheduled to sync?
It should say on either A) services lister (for the linked services that willbe updated) or B) the service template page
 
How can I force a sync?
Is this for if you already had a sync scheduled? If yes, unsure… may need to ask others. If you had not already scheduled it, just change schedule to Now
 
How can I see any sync errors? ( think I know this, but for completeness...)
I beleve the lister pages should indicate if an error occurred during sync. Obviously check the logs, but I cannot remember which specific sources unfortunately
 
What are the common causes of service templates not syncing promptly?
Conflicts or mismatch (services linked not correct somehow…), Maybe there is an issue where a restore/migration is already in effect and lasts a long time so the scheduled sync will wait until those operations are over. . May want to ask around for more
 
 What is the expected time to wait before they sync?
If it’s immediate, it should only be like 5-10s (at most) before you start to see “Sync in progress”. For time of total sync, depends on env, number of services, etc 
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...