Splunk ITSI

Why won't search complete during ITSI Entity import and Service Entity mapping - results show 1 Service and 9K Entities?

Jitu
Engager

I was trying to import Service Entities values through an ad-hoc search, however the import never completes. The search results have 1 Service and 9000 Entities associated to this.

I tried a different way of simply uploading the entities alone, the upload completes and then I try to create the service separately. I try to map entities to that service using conditions and it shows me 9000 entities matched and I save it, but again in the entities listed I am not able to see Service tagged to these entities.  I did check in the itsi_entities lookup file too. The KPIs for this service don't show up as well for some reason.

 

 

Labels (2)
Tags (3)
0 Karma

eduncan
Splunk Employee
Splunk Employee

Are there really 9,000 unique entities that are related to a service?  Make sure that in your adhoc search you are deduping on the host name or entity title name.  If you want to manually add them from a csv, you need to have a field that designates the service they are supposed to be related to.  Best practice is to use something in the actual data of the entity that shows they should be part of a service and NOT a host name because then it is not dynamic.  If you are importing via a search and you have a large number of entities that already exist, it may fail because it is trying to update existing ones.  9K entities is a large number so make sure you are deduping in your ad hoc search.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...