Splunk IT Service Intelligence

Is there a search that I can use to delete or disable a Splunk IT Service Intelligence (ITSI) service?

perrinj2
Path Finder

I am using a recurring ad hoc search to generate ITSI services using a service template. I want to be able to automate a process to delete services that are no longer required. Can I set up a recurring process using CRON that deletes services that meet a certain criteria — e.g., all services except that latest one or services older than a certain date/time. I'm using the inputs.conf file to define how the services are created.

Can I use this, or something similar, to delete or disable a service?

0 Karma
1 Solution

satokoji
Explorer

How about making a script using ITOA Interface included in ITSI REST API?

The script process is like this:
1. GET "_key" field of all target services(API : itoa_interface/service )
2. GET "create_time" field of each service title(API : itoa_interface/service/_key )
3. DELETE older services(API : itoa_interface/service/_key -X DELETE )

Check ITSI REST API reference

View solution in original post

0 Karma

satokoji
Explorer

How about making a script using ITOA Interface included in ITSI REST API?

The script process is like this:
1. GET "_key" field of all target services(API : itoa_interface/service )
2. GET "create_time" field of each service title(API : itoa_interface/service/_key )
3. DELETE older services(API : itoa_interface/service/_key -X DELETE )

Check ITSI REST API reference

0 Karma

skoelpin
SplunkTrust
SplunkTrust

I second this.. Use the API

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...