Splunk ITSI

ITSI Modules Problem

stromy
Loves-to-Learn Lots

Dears

Im using ITSI version 4.0 , i followed the documentation for the installation but yet the default modules that comes with ITSI like OS, webserver etc .., is not working probably, when ever i want to do auto discovery for entities using module search like OS one, it give me an error savedsearch is not found tho it is enabled and i can search for it in the ITSI-search,

so i start copying conflagration from the Modules to the ITOA/local/ and it worked .. is this normal case or not??
can anyone advice me!

Thanks already

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Hi @stromy,
I don't know whether you are on the right path or not, but I'm giving below steps that worked for me.

For automatic entity discovery:

  • Go to Settings > Data Inputs > ITSI Entity CSV Imports > Enable the services for which you want to enable automatic entity discovery.

For manual entity import:

  • ITSI App > Configure > Entity > Import > Import from Search > Select Module > Select Service Savedsearch > Run Search > Import.

If these steps are not working for you then I think you might have made some mistake in App installation. I'm guessing this because you are saying you are getting the error of savedsearch not found.

Hope this helps!!

0 Karma
Get Updates on the Splunk Community!

Best Strategies to Optimize Observability Costs

 Join us on Tuesday, May 6, 2025, at 11 AM PDT / 2 PM EDT for an insightful session on optimizing ...

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...