Splunk ITSI

ITSI deleting dependent service leaves blank node on Service Analyser

ewan000
Path Finder

I created (via csv import) and then deleted (via Configure Services UI) a bunch of services which were dependent services of other services.

The expected behaviour for me was that this would remove the nodes from the Service Analyzer diagram.

However, I am left with a blank node to joining the services which depended on the deleted service.

Is this a bug? How can i get rid of the blank node?

alt text

we are on ITSI 4.1.1 Splunk Enterprise 7.1.3

got some erros in the log, not sure if they are related

[itsi.consumer] [init] [exception] [48538] Saved search "Indicator - ecd48ed9-7874-4650-a885-36ff77817683 - ITSI Search" was not found, ignoring delete

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

This seems like a bug in your version. What version are you running? I just replicated your steps in my ITSI 4.0 environment and it didn't leave behind the unlabeled service.

0 Karma

ewan000
Path Finder
0 Karma

ewan000
Path Finder

we are on itsi 4.1.1 it seems to be related to mass deletes, im deleting 100's of services

0 Karma
Get Updates on the Splunk Community!

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...

Splunk AppDynamics with Cisco Secure Application

Web applications unfortunately present a target rich environment for security vulnerabilities and attacks. ...