Splunk IT Service Intelligence

Splunk ITSI Inventory

manish_singh_77
Builder

Hi Folks,

Is there a way we can fetch entities "info fields" values through search?

I tried using join search by "itsi_entities" lookup & "service_kpi_lookup" but all I can find is entity_aliases, entity_key,service_keys,App, KpiTitle and ServiceTitle fields. I know we can get the details of enitity fields from rest call "| rest /servicesNS/nobody/SA-ITOA/itoa_interface/entity/entity_key" but the challenge here is how do we pass variable entity key value through the search in rest api so that it displays all the info fields values by that search query. I tried using regex in the rest api but that didn't work for me. In short, am trying to fetch inventory data for entities which should have all the info fields values of the entities.

Please suggest if anyone is aware of the alternate method to find it.

Regards
Manish Singh

0 Karma
1 Solution

manish_singh_77
Builder

I did find the way to do this, we can use map command to pass "entity_key" values as a variable in the rest api.
map search="| rest /servicesNS/nobody/SA-ITOA/itoa_interface/entity/$entity_key$" maxsearches=300, by using the aforementioned two searches and adding map command to the search, I got all the entities field values that I was looking for.

Cheers!

View solution in original post

manish_singh_77
Builder

I did find the way to do this, we can use map command to pass "entity_key" values as a variable in the rest api.
map search="| rest /servicesNS/nobody/SA-ITOA/itoa_interface/entity/$entity_key$" maxsearches=300, by using the aforementioned two searches and adding map command to the search, I got all the entities field values that I was looking for.

Cheers!

niketn
Legend

@manish_singh_777, you should accept your own answer to mark this question as answered!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

manish_singh_77
Builder

Thanks @niketnilay

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...