I now work on ITSI service models, I want my services to be created automatically from search, based on pre-created templates and support entity filtering to simplify KPI in template. I want my service models support deep drill-down to exact problem components, I decided to make every service a separate small ITSI service, base building blocks for huge business IT services. I created the sample service models manually and I love how it looks and works.
To test service autodiscovery I have three entities named okd-node001, okd-node002 and okd-node003:
I put the following scheduled search into /opt/splunk/etc/shcluster/apps/itsi/local/inputs.conf:
When you configure a service template, there is an option that you can configure to consume entity rules from the CSV import during service creation. You should enable that during the service template creation/update.
When you're importing services automatically, try to create the appropriate entity rule for that service.