Hi @theprophet01, To get a summary of entities with their info tags you can run the excellent query by sandrosov_splun: | rest splunk_server=local /servicesNS/nobody/SA-ITOA/itoa_interface/entity r...
See more...
Hi @theprophet01, To get a summary of entities with their info tags you can run the excellent query by sandrosov_splun: | rest splunk_server=local /servicesNS/nobody/SA-ITOA/itoa_interface/entity report_as=text
| eval value=spath(value,"{}")
| mvexpand value
| eval info_fields=spath(value,"informational.fields{}"),
alias_fields=spath(value,"identifier.fields{}"),
entity_id=spath(value, "_key"),
entity_title=spath(value, "title"),
entity_name=spath(value, "identifying_name")
| appendpipe
[| mvexpand alias_fields
| eval field_value = spath(value,alias_fields."{}"), field_type="alias"
| rename alias_fields as field_name
]
| appendpipe
[| where isnull(field_type)
| mvexpand info_fields
| eval field_value = spath(value,info_fields."{}"), field_type="info"
| rename info_fields as field_name
]
| where isnotnull(field_type)
| table entity_id entity_name entity_title field_name field_value field_type This will give you results similar to this: To list the services, you can call the "getservice" custom command that comes with ITSI: | getservice
| table title, serviceid, description, service_tags, kpis, service_depends_on, services_depending_on_me, enabled, base_service_template_id, entity_rules, * That gives you these results: Cheers, Daniel