Splunk ITSI Inventory

[manish_singh_77]

Hi Folks,

Is there a way we can fetch entities "info fields" values through search?

I tried using join search by "itsi_entities" lookup & "service_kpi_lookup" but all I can find is entity_aliases, entity_key,service_keys,App, KpiTitle and ServiceTitle fields. I know we can get the details of enitity fields from rest call "| rest /servicesNS/nobody/SA-ITOA/itoa_interface/entity/entity_key" but the challenge here is how do we pass variable entity key value through the search in rest api so that it displays all the info fields values by that search query. I tried using regex in the rest api but that didn't work for me. In short, am trying to fetch inventory data for entities which should have all the info fields values of the entities.

Please suggest if anyone is aware of the alternate method to find it.

Regards
Manish Singh

[manish_singh_77 · Accepted solution]

I did find the way to do this, we can use map command to pass "entity_key" values as a variable in the rest api.
map search="| rest /servicesNS/nobody/SA-ITOA/itoa_interface/entity/$entity_key$" maxsearches=300, by using the aforementioned two searches and adding map command to the search, I got all the entities field values that I was looking for.

Cheers!

[niketn]

@manish_singh_777, you should accept your own answer to mark this question as answered!

[manish_singh_77]

Thanks @niketnilay