Splunk IT Service Intelligence

Multiple Service Analyzers / Duplicate Service Name problem

ewan000
Path Finder

Is it possible to have multiple service analyzers?

I was under the impression that "Create Service Analyzer" would create a new blank dependency diagram, to which i would add services etc. But now I have actually had an occasion to use it, I see that it merely saves search options on the default tree.

The problem I am facing is that we have a product with separate infrastructure per tennant. Each tenant will have a separate (almost)identical deployment of ServiceX which depends on ServiceY etc

I am prevented from making two services called 'ServiceX' as duplicate service titles are not allowed

  • I could have a single ServiceX and use entities to split the data but this would turn red if the other tenants ServiceY failed. Which would not be an accurate representation of the reality
  • I could prefix each service with the tenant name "TenantA.ServiceX" but this would lead to everything in the tree having very long Environment1.MarketAlpha.TennantA.SubProductQ.ServiceX names
  • I could presumably, have a seperate ITSI installation per tenant. But this will only reduce the problem and maybe introduce new problems where we have shared components

I was hoping to make a service analyser template and have a seperate dependency map for each tenant based on it. Does anyone have any good solutions?

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Hi @ewan000

Yes this is a restriction (and something I have found annoying too). You should prefix or suffix the tenant name to the service name. At least you can use the service templates to make it easier to define multiple services that are very similar.

All the best,

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...