Splunk IT Service Intelligence

Who created Services in ITSI

Reddi694325
Path Finder

In my ITSI environment already some Services and KPIs are configured. Wanted to know by whom created those Services and KPIs.

Thanks in Advance

0 Karma

PowerPacked
Builder

Hi Reddi694325

ITSI default installation comes with modules like Application server module, database module, operating system module, etc.

These modules have the services, entities, KPIS created for generic use so that you can use or duplicate them according to your use case.

You can always delete these Services, entities, kpis, from Configure section in ITSI UI app, or completely removing these modules from service side.

Thanks

0 Karma

Reddi694325
Path Finder

Thanks for the reply. I don't have access to _internal index. Is there any other way to find it?

0 Karma

Azeemering
Builder

Good question...hard to answer as they aren't exactly like knowledge objects.
What I did find is that when I create a service and then check in Splunk own's internal logging I see a match:

index = _internal sourcetype=itsi_internal_log component="itsi.services" objecttype=service method=create

0 Karma

Reddi694325
Path Finder

Thanks for your answer. But I don't have access to _internal index. Is there any other way?

0 Karma

Azeemering
Builder

The only other thing you can look at is the kvstore / lookups that might give you and indication who created them. But I cannot see a 1 to 1 relation between those and a created service.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...