Are you using the beta framework or the classic framework? ... View more

There's a toolkit of icons that's currently not published, but it's too large for me to upload here. Can you please reach out to me at [email protected] and I can send it to you? There's also a good non-standardized set of icons here: https://www.material.io/resources/icons/?style=baseline ... View more

Can you be more specific? Are you talking about glass table icons? ... View more

This might be related to the number of services/KPIs/saved searches you have. See best practice #3 here: https://www.splunk.com/en_us/blog/it/top-3-best-practices-for-configuring-splunk-itsi-in-a-large-scale-environment.html But it depends on a lot of environmental factors. When did you run the two searches? The assumption is back-to-back. But if they're separated by, say, an hour and your service analyzer only looks at the past hour, then maybe you should be getting different results. ... View more

Do you mean a glass table? Or a separate dashboard within ITSI? Also what version? ... View more

Here's a command that should work for KPIs if you have jq installed. I'd recommend to filter with jq rather than trying to process that JSON response yourself: curl -k -u username:password https://example:8089/servicesNS/nobody/SA-ITOA/itoa_interface/service?filter='\{"title":"service_name"\}' | jq '.[].kpis[].title' (Replace "service_name" with the name of the service you want to grab the KPIs from) ... View more

Hi Eric, the different algorithms used for adaptive thresholding, including Quantile and Range, are also described here: https://docs.splunk.com/Documentation/ITSI/latest/Configure/TimePolicies#Available_KPI_threshold_templates Hopefully that helps a little. ... View more

I would suggest upgrading to a more recent version of ITSI, like 4.4.0. FYI, modules and their base searches will be deprecated in future releases and their functionality will be replaced with content packs. For more information, see https://docs.splunk.com/Documentation/ITSICP/current/Config/About ... View more

An entity is an IT infrastructure component, such as: A physical or virtual server A network device (switch, router) A user (AD/LDAP) A storage system or volume An operating system process A software application (database, web server, business app) An application process instance (for example, 2 instances of the same web server application is 2 separate entities) Each entity has specific attributes and relationships to other IT processes that uniquely identify it. For example, a server that you define as an entity can have multiple IP addresses, MAC addresses, DNS names, and so on. Meanwhile, KPIs help you monitor the status of these various IT components by monitoring performance metrics, such as CPU load percentage, memory used percentage, response time, and so on. For information about key ITSI concept, like entities and KPIs, see: https://docs.splunk.com/Documentation/ITSI/latest/Configure/KeyConcepts For information about the entity split field, see: https://docs.splunk.com/Documentation/ITSI/latest/Configure/AddKPIs#Step_3:_Filter_entities ... View more

The health score calculation is based on the current severity level of service KPIs (Critical, High, Medium, Low, and Normal) and the weighted average of the importance values of all KPIs in a service. Not sure what you mean by "for the past three months". But here are the docs on how service health scores are calculated in ITSI: https://docs.splunk.com/Documentation/ITSI/latest/Configure/HealthScores ... View more

Hi Mayana, this won't delete all existing entities as long as you choose "Update Existing Entities" as the Conflict Resolution field when importing. Here are docs on importing entities through CSV: https://docs.splunk.com/Documentation/ITSI/latest/Configure/ImportCSV Here are docs on the conflict resolution field: https://docs.splunk.com/Documentation/ITSI/latest/Configure/ConflictResolution ... View more

I believe this functionality was added in the most recent release (4.4.0). I just checked and even though a user doesn't have edit access, they still see the service swapping dropdown (see screenshot): ... View more

This dropdown cannot be customized. All names in the dropdown must be ITSI users. ... View more

Smart Mode supports entity linking from ITSI version 4.4.0. ... View more

It's possible you have some things in your itsi refresh queue that is stuck and updating your services. Check the ITSI refresh queue (https://{{url}}:8089/servicesNS/nobody/SA-ITOA/storage/collections/data/itsi_refresh_queue) and see if you have any jobs running you are not expecting. You can clear out the refresh queue then try to delete services and see if that keeps the services deleted. You can also try to delete services through the REST API. ... View more

As of ITSI version 4.0.0, you can no longer associate individual notable events to an external ticket (https://docs.splunk.com/Documentation/ITSI/4.0.0/ReleaseNotes/Newfeatures#Episode_Review_.28previously_Notable_Events_Review.29) You can now only take actions on episodes: https://docs.splunk.com/Documentation/ITSI/latest/User/Setupandrunnotableeventactions ... View more

https://www.splunk.com/blog/2014/05/08/17682.html ... View more

Try checking $SPLUNK_HOME/etc/apps/SA-ITOA/local/inputs.conf (or shcluster/apps/itsi/local/inputs.conf if you're on a SHC). Locate the stanza for the recurring import and make sure 'update_type' is set to UPSERT or REPLACE, and not APPEND. If it's set to APPEND you'll get duplicates. update_type = APPEND|UPSERT|REPLACE * The update/insertion method when uploading entities. * This setting is required, and the input will not run if the setting is not present. * APPEND: ITSI makes no attempt to identify commonalities between entities. All information is appended to the table. * UPSERT: ITSI appends new entries. Existing entries (based on the value found in the title_field) have additional information appended to the existing record. * REPLACE: ITSI appends new entries. Existing entries (based on the value found in the title_field) are replaced by the new record value. * There is no default. https://docs.splunk.com/Documentation/ITSI/latest/Configure/inputs.conf ... View more

The steps here show you how to delete entities, and also how to disable recurring import searches on a single instance and search head cluster: https://docs.splunk.com/Documentation/ITSI/latest/Configure/Deleteentities ... View more

You need to turn drilldown "Off" in the Configuration panel: ... View more

If you simply wanted to add an entity rule, I would suggest linking all of the services to a service template that contains this entity rule. Then you could change it whenever you want and it would propagate to all linked services. Since the entity rule wasn't originally added to the services through a service template, there's no quick way to change it now. I would suggest: Create a service template containing just the new entity rule (with acxxxx) and link it to all of the services you want to change. (https://docs.splunk.com/Documentation/ITSI/latest/Configure/Linkservicetotemplate) Go through each service manually and remove the old entity rule (with abxxxx). That way, in the future if you want to change the entity rule again, you can make that once simple change to the template and it'll propagate to all linked services. It's a best practices to use service templates as much as possible when managing lots of services. ... View more

Not sure what version you were on, but I believe this was fixed in 4.1.0. I just tested it and the Service Analyzer filter accepts square brackets. ... View more