Splunk ITSI

ITSI Service Template Sync Schedule

ewan000
Path Finder

I have several service templates which are in the status of "Sync Scheduled" I've left them some time with no change.

What trouble shooting steps can I take? ie.

How can I find out when they are scheduled to sync?
How can I force a sync?
How can I see any sync errors? ( think I know this, but for completeness...)
What are the common causes of service templates not syncing promptly?
What is the expected time to wait before they sync?

Labels (2)
0 Karma

ehqtrainorm
Explorer

Hey mate,

 

I can't address your other questions, but I also wondered what the schedule was for syncing service templates.

In SA-ITOA/default/inputs.conf there is a stanza:

[itsi_service_template_update_scheduler://itsi_service_template_update_scheduler]
interval = 900
disabled = 0

 

If you look in SA-ITOA/bin you will find itsi_service_template_update_scheduler.py. This is the modular input script invoked by the scheduled input.

 

You can check the log by running the SPL:

index=_internal source="*itsi_service_template_update_scheduler*"

esnyder_splunk
Splunk Employee
Splunk Employee
How can I find out when they are scheduled to sync?
It should say on either A) services lister (for the linked services that willbe updated) or B) the service template page
 
How can I force a sync?
Is this for if you already had a sync scheduled? If yes, unsure… may need to ask others. If you had not already scheduled it, just change schedule to Now
 
How can I see any sync errors? ( think I know this, but for completeness...)
I beleve the lister pages should indicate if an error occurred during sync. Obviously check the logs, but I cannot remember which specific sources unfortunately
 
What are the common causes of service templates not syncing promptly?
Conflicts or mismatch (services linked not correct somehow…), Maybe there is an issue where a restore/migration is already in effect and lasts a long time so the scheduled sync will wait until those operations are over. . May want to ask around for more
 
 What is the expected time to wait before they sync?
If it’s immediate, it should only be like 5-10s (at most) before you start to see “Sync in progress”. For time of total sync, depends on env, number of services, etc 
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

A Four-Part Event Series: Full Stack Observability For the AI Era

As AI reshapes applications, infrastructure, and the way teams operate, the traditional boundaries of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...