Splunk ITSI

No Entity found against a service in ITSI

goonie
Explorer

Hi, 

I am trying to create a service using a service template, so that I can use the same KPIs( in the template) against the set of hosts that is matching my entity rules in my newly created service. 

However, when I am trying to view this service from a service analyzer, I see my service in grayed out and NO entities are being populated against the KPIs in my service. But other services ( previously created by someone else) using the same service template is working fine. 

Here are the below troubleshooting steps that I checked already -

1. Opened the KPI searches separately in a search window and have searched against my entities separately by adding '| search host= "my entitryname''  ' And it is returning values. 

 

2. Opened some of the matched entities in the Entities page. I checked the 'Assigned Service(s)' setting from the Edit Entity option.  I can see other ( previously created) by someone else) services are assigned with the entities. But My service is not listed there against the entities.  Though I can see the entities listed from the entity rule option when I open the services. 

Please help to solve this. 

I am very new to ITSI and trying  to learn ITSI. So please pardon, if this is a very basic question that I am struggling with. 

Labels (2)
Tags (3)

Sumantab88
Explorer

Facing the same issue, not sure if this is due to the latest ITSI 4.4.5 upgrade or anything related to episodes limits post-upgrade.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...