Delete entities in ITSI
When you stop data collection for a system, or a system stops sending data to Splunk IT Service Intelligence (ITSI) for another reason, the system continues to exist as an entity in ITSI until the entity is deleted.
Prerequisites
| Requirement | Description |
|---|---|
| ITSI roles | You have to have the itoa_admin or itoa_team_admin role, and have write access to the Global team. For more information, see Configure users and roles in ITSI in the Administration Manual. |
Manually delete a single entity
Follow these steps to manually delete an entity.
- From the ITSI main menu, go to Configuration then Entity Management.
- Select each entity you want to delete.
- To delete a single entity, click Edit then Delete. To delete entities in bulk, see the next section.
Delete retired entities
Follow these steps to delete retired entities in bulk.
- Select Configuration then Entity Management.
- From the Retired Entities tab, select the first checkbox in the column header to select all retired entities on the page. A banner displays the number of entities that you've selected. You can also choose to select all retired entities from the banner message.
- From the Bulk Action dropdown, select Delete selected to delete all retired entities in bulk.
- Deleting entities can't be undone. Select Delete All in the confirmation modal to complete the action. You'll receive a message notification to confirm that all entities were deleted.
Note: You can't delete or restore additional entities when the bulk delete action is running.