Splunk IT Service Intelligence

ITSI Service Template Sync Schedule

ewan000
Path Finder

I have several service templates which are in the status of "Sync Scheduled" I've left them some time with no change.

What trouble shooting steps can I take? ie.

How can I find out when they are scheduled to sync?
How can I force a sync?
How can I see any sync errors? ( think I know this, but for completeness...)
What are the common causes of service templates not syncing promptly?
What is the expected time to wait before they sync?

Labels (2)
0 Karma

ehqtrainorm
Explorer

Hey mate,

 

I can't address your other questions, but I also wondered what the schedule was for syncing service templates.

In SA-ITOA/default/inputs.conf there is a stanza:

[itsi_service_template_update_scheduler://itsi_service_template_update_scheduler]
interval = 900
disabled = 0

 

If you look in SA-ITOA/bin you will find itsi_service_template_update_scheduler.py. This is the modular input script invoked by the scheduled input.

 

You can check the log by running the SPL:

index=_internal source="*itsi_service_template_update_scheduler*"

esnyder_splunk
Splunk Employee
Splunk Employee
How can I find out when they are scheduled to sync?
It should say on either A) services lister (for the linked services that willbe updated) or B) the service template page
 
How can I force a sync?
Is this for if you already had a sync scheduled? If yes, unsure… may need to ask others. If you had not already scheduled it, just change schedule to Now
 
How can I see any sync errors? ( think I know this, but for completeness...)
I beleve the lister pages should indicate if an error occurred during sync. Obviously check the logs, but I cannot remember which specific sources unfortunately
 
What are the common causes of service templates not syncing promptly?
Conflicts or mismatch (services linked not correct somehow…), Maybe there is an issue where a restore/migration is already in effect and lasts a long time so the scheduled sync will wait until those operations are over. . May want to ask around for more
 
 What is the expected time to wait before they sync?
If it’s immediate, it should only be like 5-10s (at most) before you start to see “Sync in progress”. For time of total sync, depends on env, number of services, etc 
0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...