Splunk ITSI

Any idea on how serviceid/itsi_service_id is being mapped to service_name in itsi_summary?

Sumantab88
Explorer

So, here is an issue where I can't find some services (e.g, service x, service y. service z) under the field service_name in splunk itsi_summary index but the corresponding service_ids are there in itsi_summary index. However, when I am looking for those services in the lookup service_kpi_lookup I do find them under title field. 

When I do a simple search - 

index=itsi_summary | stats count serviceid

- I am getting a count of 1029, but then again when I do - 

index=itsi_summary | stats count by service_name
- I am getting a count of 1024, furthermore if I do -

| inputlookup service_kpi_lookup | stats count by title

- I am getting a count of 1029

So, there seems to be something broken that populates the service_name field in itsi_summary.

Can anyone help me on this. Need to understand on - how this service_name field is getting populated.

Labels (2)
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...