Splunk IT Service Intelligence (ITSI) : After removing a service, why is it still showing as a dependent child of another service in the service tree?

[ernandofs]

I removed a service, but it is still showing as a dependent child of another service in the service tree. It appears as "Undefined" instead of its original name. How do you clean this out? The service tree is not showing the correct info in this way. The service tiles work fine.

Regards,

Ernando.

[ernandofs]

We didn't clone the service. We created a new service, removed any dependencies for the initial service and dropped it. Rename the new one. (I.E Create a new service SQL-Server_new, dropped SQL-Server, and rename SQL-Server_new to SQL-Server).

PS: The Splunk support asked us to not clone because the issue could be inherited in the new service.

[rcao_splunk]

Got it ! thank you so much Ernando:D

[ernandofs]

Yes, we resolved. We opened a ticket with Splunk. The support person instructed us to create a new service same as the original service and before dropping the original service we had to remove any dependencies for that original service. When we finally dropped the original service with the hanging child services, everything went away.,Yes, we did. I opened a ticket with Splunk. The support person instructed us to create a new service same to the original service were the child services were hanging and to remove any dependency with that original service and drop the original services afterward. When I dropped the original service everything went away and I start to use the new service.

[rcao_splunk]

thank you for your reply. Not sure I get it. Base on your screenshot, clone a new SQL-Server Service(call it New_SQL-Server) and remove any dependencies for SQL-Server Service, then remove SQL-Server Service, maybe the undefined service has been dropped. At last rename the New_SQL-Server to SQL-Server. Is that right? Thank you.:)

[ernandofs]

Current Application: IT Service Intelligence
App Version
3.1.3
App Build
4536798501

[rcao_splunk]

Hi Ernando, have you solved this problem? Thanks!

[kanwu_splunk]

What ITSI version is this?

[ernandofs]

Current Application: IT Service Intelligence
App Version
3.1.3
App Build
4536798501

[yannK]

Wait a bit for the Service-healthscores to be udpated, then reload with a shorter timerange, does it still appears ?

[ernandofs]

Thanks for your reply.

We have removed the services over a week ago. We restarted the entire Splunk environment including ITSI and the services removed are still showing as children of another service (they were children before). It looks like that only the name of the services were removed but the dependencies hasn't. The services shows as "Undefined".

Attached is a picture showing the issue.

Regards,

Ernando.