Splunk ITSI

How to Create sub Services in Splunk ITSI

nasrinmulani
New Member

Hi All,

I need to know how to create sub services, for example "Laptop" will be main service and then "Laptop-CPU" "Laptop-Performance" , these will be sub services under "Laptop" Service.
When we will drag and drop the service health of Laptop service on Glass table then we should get the overall health of all the services.

Anyone knows about how to create sub service, please let me know.

Thanks in Advance!!

0 Karma
1 Solution

PowerPacked
Builder

Hi @nasrinmulani

In the above case, Laptop-CPU & Laptop-Performance should be considered as entities of Laptop.

in either bulk import or single creation, you will have option of service dependency tree. from where you can configure whih entities are treated as sub services under main service.

& coming to service health of main service always depends on service health of sub services.

------ service health score of sub services are considered as kpis of importance of 11 in main service. ---- if any of the sub services fails the main service automatically turns into critical.

Have a look at these docs.
https://docs.splunk.com/Documentation/ITSI/3.1.1/Configure/Addservicedependencies

Thanks

View solution in original post

0 Karma

nasrinmulani
New Member

Thanks you!!

It's really helpful

0 Karma

PowerPacked
Builder

Hi @nasrinmulani

In the above case, Laptop-CPU & Laptop-Performance should be considered as entities of Laptop.

in either bulk import or single creation, you will have option of service dependency tree. from where you can configure whih entities are treated as sub services under main service.

& coming to service health of main service always depends on service health of sub services.

------ service health score of sub services are considered as kpis of importance of 11 in main service. ---- if any of the sub services fails the main service automatically turns into critical.

Have a look at these docs.
https://docs.splunk.com/Documentation/ITSI/3.1.1/Configure/Addservicedependencies

Thanks

0 Karma
Get Updates on the Splunk Community!

Splunk Search APIを使えば調査過程が残せます

   このゲストブログは、JCOM株式会社の情報セキュリティ本部・専任部長である渡辺慎太郎氏によって執筆されました。 Note: This article is published in both Japanese ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...