Splunk ITSI

Is there a search that I can use to delete or disable a Splunk IT Service Intelligence (ITSI) service?

perrinj2
Path Finder

I am using a recurring ad hoc search to generate ITSI services using a service template. I want to be able to automate a process to delete services that are no longer required. Can I set up a recurring process using CRON that deletes services that meet a certain criteria — e.g., all services except that latest one or services older than a certain date/time. I'm using the inputs.conf file to define how the services are created.

Can I use this, or something similar, to delete or disable a service?

0 Karma
1 Solution

satokoji
Explorer

How about making a script using ITOA Interface included in ITSI REST API?

The script process is like this:
1. GET "_key" field of all target services(API : itoa_interface/service )
2. GET "create_time" field of each service title(API : itoa_interface/service/_key )
3. DELETE older services(API : itoa_interface/service/_key -X DELETE )

Check ITSI REST API reference

View solution in original post

0 Karma

satokoji
Explorer

How about making a script using ITOA Interface included in ITSI REST API?

The script process is like this:
1. GET "_key" field of all target services(API : itoa_interface/service )
2. GET "create_time" field of each service title(API : itoa_interface/service/_key )
3. DELETE older services(API : itoa_interface/service/_key -X DELETE )

Check ITSI REST API reference

0 Karma

skoelpin
SplunkTrust
SplunkTrust

I second this.. Use the API

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...