Splunk IT Service Intelligence

Is there a search that I can use to delete or disable a Splunk IT Service Intelligence (ITSI) service?

perrinj2
Path Finder

I am using a recurring ad hoc search to generate ITSI services using a service template. I want to be able to automate a process to delete services that are no longer required. Can I set up a recurring process using CRON that deletes services that meet a certain criteria — e.g., all services except that latest one or services older than a certain date/time. I'm using the inputs.conf file to define how the services are created.

Can I use this, or something similar, to delete or disable a service?

0 Karma
1 Solution

satokoji
Explorer

How about making a script using ITOA Interface included in ITSI REST API?

The script process is like this:
1. GET "_key" field of all target services(API : itoa_interface/service )
2. GET "create_time" field of each service title(API : itoa_interface/service/_key )
3. DELETE older services(API : itoa_interface/service/_key -X DELETE )

Check ITSI REST API reference

View solution in original post

0 Karma

satokoji
Explorer

How about making a script using ITOA Interface included in ITSI REST API?

The script process is like this:
1. GET "_key" field of all target services(API : itoa_interface/service )
2. GET "create_time" field of each service title(API : itoa_interface/service/_key )
3. DELETE older services(API : itoa_interface/service/_key -X DELETE )

Check ITSI REST API reference

0 Karma

skoelpin
SplunkTrust
SplunkTrust

I second this.. Use the API

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...