Splunk ITSI

Import entities from csv in splunk ITSI

Pooja1
Loves-to-Learn Everything

Hi,

I want to import the entities via csv to entity management in Splunk ITSI,
so please help me with this.

Thanks

Tags (1)
0 Karma

nouraali369
Observer

Hi @skramp,

if you are talking about this post , i am the post writer, thought to post the question in Splunk community to get support in this.
Below is one of the CSVs i have tried import:

ServiceTitle;ServiceDescription;DependentServices;
Splunk;;SHC | IND;
SHC;;Server1;
IND;;server2;
server1;;;
server2;;;

in the 1st environment it gives:

File preview : 0 total lines

 

in the 2nd environment, it gets imported successfully, displaying all the rows.

0 Karma

skramp
SplunkTrust
SplunkTrust

haha, so you are the same one, awesome!

0 Karma

lperini_splunk
Splunk Employee
Splunk Employee

In Splunk IT Service Intelligence (ITSI), you can import entities via CSV to Entity Management using the following steps:

  1. Prepare Your CSV File:

    • Make sure your CSV file contains the necessary information for each entity, such as title, identifier, and any other relevant fields.
    • The CSV file should have a header row with column names.
  2. Access Entity Management:

    • Log in to your Splunk instance and navigate to ITSI.
    • In the ITSI main menu, go to Configure > Entity Management.
  3. Open Import Wizard:

    • Click on Import Entities.
  4. Select CSV File:

    • Click on Browse or similar, depending on your system, to locate and select your CSV file.
  5. Map Fields:

    • ITSI will attempt to automatically map fields from your CSV file to ITSI entity fields. Review the mapping to ensure accuracy.
    • If needed, manually map fields by dragging the appropriate CSV columns to the corresponding ITSI fields.
  6. Preview and Validate:

    • Preview the entities to ensure they are correctly mapped and that the data looks accurate.
    • Validate the data to check for any errors or missing information.
  7. Complete the Import:

    • If everything looks correct, proceed with the import by clicking Finish or a similar button.
    • Splunk ITSI will process the CSV file and import the entities into Entity Management.
  8. Verify Import:

    • After the import is complete, verify that the entities are visible in the Entity Management interface.

It's important to note that the exact steps and options might vary slightly depending on the version of Splunk ITSI you are using. Always refer to the official Splunk documentation for your specific version for the most accurate and up-to-date information.

For more information:
https://docs.splunk.com/Documentation/ITSI/latest/Entity/ImportCSV#Steps

0 Karma

nouraali369
Observer

 

Hello,
I am following this  to import multiple services along with their dependencies, and below is the sample excel CSV  i am trying to import, utf-8 encoded :
Service TitleService DescriptionDependent ServicesSplunk SHC | INDSHC Server1IND server2server1  server2  
But when the upload is finished, the file preview shows 0 total lines as in the below screenshot:
 
 

When i tried to do the same file import in another splunk environment, it went well.

Given that i am admin in both environments and both environments with versions as below:

  1. Splunk Version: 9.0.4.1
  2. ITSI Version: 4.18.1
    What could be the issue/missing in the first environment ?
0 Karma

skramp
SplunkTrust
SplunkTrust

A few days ago I've seen someone in the Slack Usergroup who also had a problem with ITSI 4.18.1, but just on one of his environments. Can you explain your error a little more specific, do you get an error message or does Splunk only tells you there is no content in your csv? Can you please try to import your csv on a different Splunk environment, maybe which is in a different version? Just to check.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...