Splunk ITSI

ITSI Service Template Sync Schedule

ewan000
Path Finder

I have several service templates which are in the status of "Sync Scheduled" I've left them some time with no change.

What trouble shooting steps can I take? ie.

How can I find out when they are scheduled to sync?
How can I force a sync?
How can I see any sync errors? ( think I know this, but for completeness...)
What are the common causes of service templates not syncing promptly?
What is the expected time to wait before they sync?

Labels (2)
0 Karma

ehqtrainorm
Explorer

Hey mate,

 

I can't address your other questions, but I also wondered what the schedule was for syncing service templates.

In SA-ITOA/default/inputs.conf there is a stanza:

[itsi_service_template_update_scheduler://itsi_service_template_update_scheduler]
interval = 900
disabled = 0

 

If you look in SA-ITOA/bin you will find itsi_service_template_update_scheduler.py. This is the modular input script invoked by the scheduled input.

 

You can check the log by running the SPL:

index=_internal source="*itsi_service_template_update_scheduler*"

esnyder_splunk
Splunk Employee
Splunk Employee
How can I find out when they are scheduled to sync?
It should say on either A) services lister (for the linked services that willbe updated) or B) the service template page
 
How can I force a sync?
Is this for if you already had a sync scheduled? If yes, unsure… may need to ask others. If you had not already scheduled it, just change schedule to Now
 
How can I see any sync errors? ( think I know this, but for completeness...)
I beleve the lister pages should indicate if an error occurred during sync. Obviously check the logs, but I cannot remember which specific sources unfortunately
 
What are the common causes of service templates not syncing promptly?
Conflicts or mismatch (services linked not correct somehow…), Maybe there is an issue where a restore/migration is already in effect and lasts a long time so the scheduled sync will wait until those operations are over. . May want to ask around for more
 
 What is the expected time to wait before they sync?
If it’s immediate, it should only be like 5-10s (at most) before you start to see “Sync in progress”. For time of total sync, depends on env, number of services, etc 
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...