Bulk entity import worked but trying to understand why recurring ITSI imports aren't occurring:
https://docs.splunk.com/Documentation/ITSI/4.3.0/Configure/Recurringimport
Working on single instance
Under step 5 there is a note: The recurring import search executes as splunk-system-user, which returns entities from datasets that exist in indexes that the user creating the import might not have access to.
No errors when looking in _audit index in regards to splunk-system-user, how can I determine if this is the issue since I can't assign the role capabilities?
Using REPLACE as the update type and log level set to DEBUG and see it run but no errors, my test is deleting an alias in one of the entities to see if it will get added. When running the saved search either scheduled or by itself it returns data as needed, it seems like the replace option isn't working. I don't have another example to compare to so I'm not sure what the logs should look like for a successful import, below is the log file.
2019-08-01 14:00:00,550 DEBUG [itsi.csv_import] [itoa_storage] [is_available] [104610] Querying if KV store is available: True
2019-08-01 14:00:00,550 INFO [itsi.csv_import] [itoa_storage] [wait_for_storage_init] [104610] KV store has been initialized.
2019-08-01 14:00:00,550 INFO [itsi.csv_import] [itsi_csv_import] [do_run] [104610] import_from_search: True
2019-08-01 14:00:00,550 INFO [itsi.csv_import] [itsi_csv_import] [do_run] [104610] import_info: {"import_from_search": "1", "service": {"titleField": "Service Title", "serviceEnabled": "1", "criticality": "", "descriptionColumns": ["Service Description"], "serviceSecurityGroup": "default_itsi_security_group", "backfillEnabled":"0"}, "search_string": "| savedsearch \"SPLUNK:firewall_entities_search\"", "service_dependents": [], "selected_services": null, "interval": "0 */2 * * *","index_latest": "now", "updateType": "replace", "index_earliest": "-60m", "log_level": "DEBUG", "entity": {"identifyingFields": ["host"], "informationalFields": ["bunit", "owner", "os", "category"], "titleField": "device_hostname", "mergeField": "undefined", "service_column": [], "fieldMapping": {}, "descriptionColumns": ["description"]}, "selectedServices": [], "service_rel": [], "template": {}}
2019-08-01 14:00:17,272 DEBUG [itsi.csv_import] [itsi_csv_import] [import_via_search] [104610] Done running search. Modular input will now try to import your entities/services.
2019-08-01 14:00:17,294 INFO [itsi.csv_import] [itoa_bulk_import_specification] [_get_fields_to_import] [104610] Fields to Import: SpecFields(entity_fields=['os', 'device_hostname', 'description', 'category', 'bunit', 'owner', 'host'], service_fields=['', 'Service Title', 'Service Description'], entity_relationship_fields=[])
2019-08-01 14:00:17,300 INFO [itsi.csv_import] [itoa_bulk_import] [_bulk_import] [104610] CSV data load initializing mark start=1564668017.3
... View more