Splunk IT Service Intelligence

No Entity found against a service in ITSI



I am trying to create a service using a service template, so that I can use the same KPIs( in the template) against the set of hosts that is matching my entity rules in my newly created service. 

However, when I am trying to view this service from a service analyzer, I see my service in grayed out and NO entities are being populated against the KPIs in my service. But other services ( previously created by someone else) using the same service template is working fine. 

Here are the below troubleshooting steps that I checked already -

1. Opened the KPI searches separately in a search window and have searched against my entities separately by adding '| search host= "my entitryname''  ' And it is returning values. 


2. Opened some of the matched entities in the Entities page. I checked the 'Assigned Service(s)' setting from the Edit Entity option.  I can see other ( previously created) by someone else) services are assigned with the entities. But My service is not listed there against the entities.  Though I can see the entities listed from the entity rule option when I open the services. 

Please help to solve this. 

I am very new to ITSI and trying  to learn ITSI. So please pardon, if this is a very basic question that I am struggling with. 

Labels (2)
Tags (3)


Facing the same issue, not sure if this is due to the latest ITSI 4.4.5 upgrade or anything related to episodes limits post-upgrade.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...