Overview of creating services in ITSI

An IT Service Intelligence (ITSI) service is a representation of a real-world IT service that you can use to monitor the health of IT systems and business processes. For more information about ITSI services, see Overview of Service Insights in ITSI. The following diagram shows the steps to configure an ITSI service:

ServiceConfig.png

After you initially create one or more services, you must perform some manual configuration, including adding entity rules to filter to entities, adding KPIs to monitor the service's health, and adding service dependencies. You can then use ITSI to monitor service health, perform root-cause analysis, set up threshold-based alerts, and track compliance with organizational SLAs (service-level agreements).

Prerequisites

  • You must have the write_itsi_service capability to create services. The itoa_admin and itoa_team_admin roles have this capability by default.
  • You must have write access to a team to edit services belonging to that team. If your organization hasn't created teams, all services reside in the Global team. For information about teams, see Implement teams in ITSI in the Administration Manual.
  • Before you create a service, define the entities you want the service to contain. You can add the entities to the service when you configure the service. For more information, see Overview of entity integrations in ITSI in the Entity Integrations Manual.

Step 1: Create one or more services

There are four ways to create services in ITSI:

Create a single service in ITSI

Create new services one at a time in the UI. Manually create a service from scratch or use service templates to automatically populate the entity rules and KPIs.

Import services from a CSV file in ITSI

Import new services and link them to service templates from a CSV file. This method lets you import a hierarchy of dependent services with entities already associated. You can also create a modular input that runs automated recurring imports of the CSV file contents.

Import services from a search in ITSI

Add services and link services to service templates from an ITSI module, saved search, or ad hoc search.

Discover services and KPIs with AI

ITSI Cloud administrators can use AI-guided discovery to create a draft service model from indexed data, with recommendations for services, KPIs, dependencies, and KPI searches.

Step 2: Define entity rules (Optional)

Entity rules let you dynamically filter KPI searches based on entity alias matches. Define entity rules to associate entities with KPIs at the service level, which makes it unnecessary to specify entity identifying fields for each KPI search. For detailed instructions, see Define entity rules for a service in ITSI.

Step 3: Add KPIs to the service

A Key Performance Indicator (KPI) is a recurring saved search that returns the value of an IT performance metric, such as CPU load percentage, memory used percentage, response time, and so on. You can define a KPI from a metrics search, a an ad hoc search, or a base search. For detailed instructions, see Overview of creating KPIs in ITSI.

Step 4: Add service dependencies (Optional)

Adding service dependencies can help you detect if one service is having a negative impact on another service, and can be useful in performing root cause analysis. For detailed instructions, see Add service dependencies in ITSI.

Discover services and KPIs with AI

Use AI-driven Service and KPI discovery to curate a service model from scratch in Splunk IT Service Intelligence. The 4-step guided workflow can recommend services, KPIs, service dependencies, and the searches used by those KPIs. Review and refine the recommendations before you publish them to ITSI.

  • Confirm that your ITSI release and deployment support AI-driven service and KPI discovery and that the feature is available in your environment.

  • Make sure the data you want to use is indexed and searchable.

  • Make sure you have the permissions required to create and publish ITSI services.

  • Plan which business or technical services you want to monitor and which indexes are relevant to those services.

Discovery can take time, depending on your environment and the data sources you select. The process continues in the background, so you can return to the discovery session later.

The workflow has four steps: Monitoring intent, Data sources, Services, and Review. Recommendations remain in the discovery sandbox while you review them. Publishing makes the selected services and KPIs live in ITSI.

Start a discovery session

You can start discovery from either of these locations in ITSI:

  • From Service Analyzer, select Discover services > New discovery.

  • From Configuration > Service Monitoring > Service and KPI Management, open the Create Service menu and select Discover Services.

The Service and KPI discovery session list shows each session's name, status, creator, service and unique KPI counts, and last modification time. Select New discovery to begin, or open an existing session to return to your work.

Choose an industry and monitoring intent

  1. In Monitoring intent, select an industry and the intents that match the services you want to monitor. The industry and intents help ITSI interpret your data in context.

  2. If your environment does not fit one industry, select Custom / Cross-Industry.

  3. If you are unsure which intents to select, choose Not sure? Start with AI guidance. Continue to data-source selection, then review the suggested services and KPIs before publishing.

  4. Optionally, expand Environment details and provide information in these fields:

  • Describe your monitoring goals: Explain the operational outcomes or describe the services or applications you want to monitor.

  • Services/applications: Identify services or applications you expect the model to include.

  • Technology stack: Describe relevant technologies, such as application platforms, databases, or operating systems.

Keep these details consistent with the data available to discovery. You can leave the optional fields blank.

Select Next.

Select data sources

  1. In Data sources, review the log and metric indexes that the wizard identifies as relevant. Review each source's confidence level.

  2. Select View details to inspect the available information. Use AI reasoning to understand why an index was recommended. Use Search to review the lookback period or filter the index with an index query.

  3. Add or remove indexes, customize your selection, or preview an index before continuing. If an index is not in the initial recommendations, expand Other indexes and use its pagination controls to locate it. Inspect the data before adding it. You can also filter the index list. You can analyze up to five indexes per discovery.

  4. If you cannot find an expected index, confirm that its data is indexed and searchable and that your account can access it. Newly added data might also require the environment's data-summary process to complete.

  5. Select Discover to start discovery.

Review discovered services and KPIs

  1. Monitor progress in the Services step. The progress view shows processing stages and service discovery pipeline activity. Select Open in Search to inspect pipeline events in Search & Reporting. After generation, use View service discovery logs to inspect the discovery logs. Discovery continues in the background if you leave the page. Return through the session list to reopen it. The session receives an automatically generated name that you can change in Review.

  2. When discovery finishes, review the suggested services in card or tree view. Check the parent and child relationships, dependency direction, and the explanation for each recommendation.

  3. Select View details to inspect a recommendation:

  • In AI reasoning, review why the service was selected.

  • In KPIs, review the suggested KPI names, generated searches, calculation settings, and previews. Add or remove KPIs, rename them, or edit their settings.

  • In Dependencies, review and change the dependent services. You can include an existing ITSI service in the dependency model.

  • In Settings, review the service health calculation. Some services can represent an aggregate health score through dependencies without having individual KPIs.

  1. Add, remove, customize, or preview services in your selection. Use Add service to add a service to the discovery model. Review generated KPI searches and settings before publishing. Generated KPIs can create individual recurring searches, so consider the search load created by the KPIs you select. Review how existing service relationships are affected before publishing.

  2. Select Next to review the discovery.

Review threshold and alert settings

Review the threshold type and alert rules for the KPIs you plan to publish. If you use Adaptive thresholding, make sure the Search and calculate backfill covers the selected training window. Calibration occurs after you publish and the first training run finishes. Allow time for backfill and training before evaluating the resulting thresholds.

Review and configure Alert rules for your monitoring needs. Publishing a discovery does not by itself establish that threshold training has finished or that the required alert rules are configured.

Publish the discovery

  1. In Services, confirm which services you want to include. Deselect recommendations that are outside your monitoring scope, and verify the remaining dependency model.

  2. In Review, optionally rename the session using the edit control next to its name. Check the industry, monitoring intents, and data sources, then review the services, KPIs, dependencies, and enabled states. Resolve naming conflicts or duplicate services and KPIs before publishing.

  3. Use Bulk actions to enable, disable, or delete selected recommendations when needed. Distinguish row selection for a bulk action from the set of services you intend to publish, and verify the final set before continuing.

  4. Select Publish. Review any confirmation displayed by your release, including selected service and KPI search counts, search impact, and potential duplicates, before confirming publication.

  5. Wait for the publish-success message. Open Service and KPI Management to verify the created services, then open Service Analyzer to review the model. Allow time for scheduled KPI data collection and any required backfill or threshold training.

Publishing creates ITSI knowledge objects and recurring KPI searches. Review the selected objects and their potential search impact before publishing.