Splunk IT Service Intelligence

Splunk IT Service Intelligence: Is there a list of KVstore collection used by ITSI?

VatsalJagani
Motivator

I know ITSI is using KVstore to store details like ITSI team, Services, KPIs, templates, Glass Tables, etc.
Is there any list I can get which data ITSI stores in which lookup or KVstore collection?

Bonus question:
Where does ITSI stores KPI data (data-model, kvstore), or it just always search from index data?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You can get a list of collections used by ITSI with the query

| rest /services/configs/conf-collections | search eai:acl.app="*ITSI*" OR title="*ITSI*" | fields eai:acl.app title

If you have CLI access, btool can also give you a list.

splunk btool --debug collections list | grep -i itsi

KPIs are searches so the data comes from indexes. Search results are stored in the itsi_summary index.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You can get a list of collections used by ITSI with the query

| rest /services/configs/conf-collections | search eai:acl.app="*ITSI*" OR title="*ITSI*" | fields eai:acl.app title

If you have CLI access, btool can also give you a list.

splunk btool --debug collections list | grep -i itsi

KPIs are searches so the data comes from indexes. Search results are stored in the itsi_summary index.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

SamHTexas
Builder

Good day Rich, Thank u for your expert help sir as always. How would I search for a copy of the KVstores on each Splunk server & the KPIs for the sake of backing them up? Thanks

Tags (1)
0 Karma

VatsalJagani
Motivator

Thanks!!! It gave me the list, but is there any document for ITSI admin to check for troubleshooting by which I can find where ITSI is storing data about services, kpis and glass tables, etc.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There is no such document. What specific problem are you trying to troubleshoot?

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!