Splunk IT Service Intelligence: Is there a list of KVstore collection used by ITSI?

[VatsalJagani]

I know ITSI is using KVstore to store details like ITSI team, Services, KPIs, templates, Glass Tables, etc.
Is there any list I can get which data ITSI stores in which lookup or KVstore collection?

Bonus question:
Where does ITSI stores KPI data (data-model, kvstore), or it just always search from index data?

[richgalloway · Accepted solution]

You can get a list of collections used by ITSI with the query

| rest /services/configs/conf-collections | search eai:acl.app="*ITSI*" OR title="*ITSI*" | fields eai:acl.app title

If you have CLI access, btool can also give you a list.

splunk btool --debug collections list | grep -i itsi

KPIs are searches so the data comes from indexes. Search results are stored in the itsi_summary index.

[SamHTexas]

Good day Rich, Thank u for your expert help sir as always. How would I search for a copy of the KVstores on each Splunk server & the KPIs for the sake of backing them up? Thanks

[VatsalJagani]

Thanks!!! It gave me the list, but is there any document for ITSI admin to check for troubleshooting by which I can find where ITSI is storing data about services, kpis and glass tables, etc.

[richgalloway]

There is no such document. What specific problem are you trying to troubleshoot?