Splunk IT Service Intelligence

Splunk ITSI Inventory

Hi Folks,

Is there a way we can fetch entities "info fields" values through search?

I tried using join search by "itsientities" lookup & "servicekpilookup" but all I can find is entityaliases, entitykey,servicekeys,App, KpiTitle and ServiceTitle fields. I know we can get the details of enitity fields from rest call "| rest /servicesNS/nobody/SA-ITOA/itoainterface/entity/entitykey" but the challenge here is how do we pass variable entity key value through the search in rest api so that it displays all the info fields values by that search query. I tried using regex in the rest api but that didn't work for me. In short, am trying to fetch inventory data for entities which should have all the info fields values of the entities.

Please suggest if anyone is aware of the alternate method to find it.

Regards
Manish Singh

0 Karma
1 Solution

I did find the way to do this, we can use map command to pass "entitykey" values as a variable in the rest api.
map search="| rest /servicesNS/nobody/SA-ITOA/itoa
interface/entity/$entity_key$" maxsearches=300, by using the aforementioned two searches and adding map command to the search, I got all the entities field values that I was looking for.

Cheers!

View solution in original post

I did find the way to do this, we can use map command to pass "entitykey" values as a variable in the rest api.
map search="| rest /servicesNS/nobody/SA-ITOA/itoa
interface/entity/$entity_key$" maxsearches=300, by using the aforementioned two searches and adding map command to the search, I got all the entities field values that I was looking for.

Cheers!

View solution in original post

SplunkTrust
SplunkTrust

@manishsingh777, you should accept your own answer to mark this question as answered!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Thanks @niketnilay

0 Karma