Splunk IT Service Intelligence

Is it possible to export ITSI Services?

theprophet01
Explorer

I'm looking to export Service from Splunk ITSI however, there is no direct export feature in the GUI (at least within the Services page). Is there any other way to export ITSI services?

Labels (2)
0 Karma
1 Solution

spavin
Path Finder

Hi @theprophet01,

If you have a itoa_admin role,  you can export services, entities, glass tables, KPI searches, templates etc from the following menu:

Configuration > Backup/Restore

  1. Click Create Job > Create Backup Job
    spavin_0-1712291776650.png

     

  2. Select Partial Backup, give it a name and description, uncheck include conf files, then click next
    spavin_1-1712291844210.png

     

  3. Select the services you'd like to backup
    spavin_2-1712291884281.png

     

  4. Click Save and Backup
    spavin_3-1712291906331.png

     

  5. You will be taken to the Backup/Restore jobs page, where your job will be queued. When it's finished, usually after a few minutes, you can download the backup as a zip. 

  6. Go to the same page on a different Splunk instance to restore it - this time select Restore Job and upload the zip file.

 

See the capabilities here: https://docs.splunk.com/Documentation/ITSI/4.18.1/Configure/Capabilities

You'll need the ones listed under "Backup/Restore" which by default is only given to itoa_admin.

View solution in original post

spavin
Path Finder

Hi @theprophet01,

If you have a itoa_admin role,  you can export services, entities, glass tables, KPI searches, templates etc from the following menu:

Configuration > Backup/Restore

  1. Click Create Job > Create Backup Job
    spavin_0-1712291776650.png

     

  2. Select Partial Backup, give it a name and description, uncheck include conf files, then click next
    spavin_1-1712291844210.png

     

  3. Select the services you'd like to backup
    spavin_2-1712291884281.png

     

  4. Click Save and Backup
    spavin_3-1712291906331.png

     

  5. You will be taken to the Backup/Restore jobs page, where your job will be queued. When it's finished, usually after a few minutes, you can download the backup as a zip. 

  6. Go to the same page on a different Splunk instance to restore it - this time select Restore Job and upload the zip file.

 

See the capabilities here: https://docs.splunk.com/Documentation/ITSI/4.18.1/Configure/Capabilities

You'll need the ones listed under "Backup/Restore" which by default is only given to itoa_admin.

theprophet01
Explorer

this is perfect, thanks @spavin !

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...