Splunk IT Service Intelligence

Is there a search that I can use to delete or disable a Splunk IT Service Intelligence (ITSI) service?

perrinj2
Path Finder

I am using a recurring ad hoc search to generate ITSI services using a service template. I want to be able to automate a process to delete services that are no longer required. Can I set up a recurring process using CRON that deletes services that meet a certain criteria — e.g., all services except that latest one or services older than a certain date/time. I'm using the inputs.conf file to define how the services are created.

Can I use this, or something similar, to delete or disable a service?

0 Karma
1 Solution

satokoji
Explorer

How about making a script using ITOA Interface included in ITSI REST API?

The script process is like this:
1. GET "_key" field of all target services(API : itoa_interface/service )
2. GET "create_time" field of each service title(API : itoa_interface/service/_key )
3. DELETE older services(API : itoa_interface/service/_key -X DELETE )

Check ITSI REST API reference

View solution in original post

0 Karma

satokoji
Explorer

How about making a script using ITOA Interface included in ITSI REST API?

The script process is like this:
1. GET "_key" field of all target services(API : itoa_interface/service )
2. GET "create_time" field of each service title(API : itoa_interface/service/_key )
3. DELETE older services(API : itoa_interface/service/_key -X DELETE )

Check ITSI REST API reference

View solution in original post

0 Karma

skoelpin
SplunkTrust
SplunkTrust

I second this.. Use the API

0 Karma