Why is Splunk ITSI summary index not showing "service_name"?

[AHAR]

Hello everyone,

I hope you're doing well. I'm reaching out to this forum for some support regarding an issue I'm facing with Splunk ITSI. Specifically, I'm having trouble getting the service_name field to show up in the summary index. I have already tried updating the lookup, but unfortunately, the service_name field is still not being displayed. The service_name field is essential for my analysis, and its absence is hindering my progress.

I have taken the following steps to address the issue:

1. Updated the lookup: I made sure to modify the lookup associated with the summary index to include the service_name field. However, despite this update, the field is still not appearing.

Despite my efforts, I haven't been able to identify the root cause of the problem. Therefore, I'm turning to this community in the hopes that someone might have encountered a similar issue or can offer guidance on how to resolve it.

If anyone has any suggestions, insights, or possible solutions to help me display the service_name field in the summary index, I would greatly appreciate it. Any troubleshooting steps, configuration changes, or alternative approaches you can recommend would be of tremendous help.

Thank you in advance for your assistance. Your expertise and support are invaluable to me, and I look forward to any advice or suggestions you can provide.

Best regards, AHAR

[srauhala_splunk]

Hi AHAR! 

I hope you managed to find a solution already but if not you can try the following. 

## Here is what you are looking for: 

index=itsi_summary
| lookup service_kpi_lookup _key as itsi_service_id OUTPUT title as service_name
| table _time kpi, alert_*, entity_* service*,indexed_is_service_aggregate



## IF you want to filter down to a subset of your services and or KPIs use this: 
 
index=itsi_summary [|`service_kpi_list` | search service_name="MY_SERVICE" kpi_name="MY_KPI" | fields kpiid | format ]
| lookup service_kpi_lookup _key as itsi_service_id OUTPUT title as service_name
| table _time kpi, alert_*, entity_* service*,indexed_is_service_aggregate

/Seb