Troubleshoot issues related to service import

Troubleshoot issues that may occur before or after using a service import module in a content pack.

This topic describes how to troubleshoot the following issues that may occur during or after using a service import module:

Service doesn’t have entity rules even though its service template does

Troubleshoot a published or unpublished service that is missing entity rules.

This issue may affect published services as well as unpublished services viewed in the service sandbox.

When a service is selected on the Service and KPI management page or service sandbox, the Entities tab doesn't show any entity rules even though the linked service template has entity rules.

The service template title in ITSI differs from the service_template value provided in fetch_services_spl in the itsi_service_import_flow_data.conf file. As a result, the service template wasn't linked to the service.

To resolve this issue, you can either update the service template title in ITSI or update the service_template value in the itsi_service_import_flow_data.conf file.

  1. Identify the service template title in ITSI:
    1. Open the itsi_service_import_flow_data.conf file for the content pack.
    2. In the dependencies_for_service_import/service_templates section, identify the key for the service template. For example, da-itsi-cp-cisco-data-center-cisco-nexus-fabric.
    3. Invoke the following GET REST API endpoint with the service template key. This API call returns a JSON payload that contains the service template title in ITSI.
      CODE 
      https://<host>:8089/servicesNS/nobody/SA-ITOA/itoa_interface/base_service_template/<service_template_key>
    4. In the JSON payload, identify the value for title. This is the service template title in ITSI.
      Example JSON payload:
      JSON 
      {"title": "Cisco Nexus Fabric", "description": "", "sec_grp": "default_itsi_security_group", "tags": [], "kpis": [{"title": "Capacity Anomalies", "description": "Count of anomalies for Capacity category", "entity_id_fields": "itsi_entity_id", "entity_breakdown_id_fields":
...}
  2. Identify the service_template value provided in fetch_services_spl in the itsi_service_import_flow_data.conf file.
    Example fetch_services_spl snippet in the itsi_service_import_flow_data.conf file:
    JSON 
    fetch_services_spl = search `cisco_dc_nd_index` sourcetype="cisco:dc:nd:fabrics" ownerCluster="{owner_cluster}" | dedup ownerCluster name | eval fabric_name=name, service_title=name, service_dependency=null(), service_template="Cisco Nexus Fabric"...
  3. Use either of the following options to align the service template title in ITSI with the service_template value in the itsi_service_import_flow_data.conf file:
    Option Description
    Change the service template title in ITSI to match the service_template value in the itsi_service_import_flow_data.conf file.
    1. From the ITSI main menu, select Configuration > Service Monitoring > Service Templates.

    2. Select the service template.

    3. Select the pencil icon to edit the service template title to match the service_template value you identified in step 2.
    Change the service_template value in the itsi_service_import_flow_data.conf file to match the service template title in ITSI.
    1. In the itsi_service_import_flow_data.conf file, update the service_template value in fetch_services_spl to match the title you identified in step 1.

    2. Restart Splunk Enterprise or reload the .conf file for the changes to take effect.
  4. If you already published the services, delete them:
    1. From the ITSI main menu, select Configuration > Service Monitoring > Service Templates.
    2. Check the boxes for the services.
    3. Select Bulk action > Delete
  5. Re-import the services to link them to the service template:
    1. From the ITSI main menu, select Configuration > Data Integrations.
    2. Select the Content library tab.
    3. Select your content pack.
    4. Select the Service import modules tab.
    5. Select and complete the service import module for the services you want to re-import.

Service doesn’t have a linked service template

Troubleshoot a published or unpublished service that is missing a linked service template.

On the Service and KPI Management page, the Service Template column for the service has a value of Not linked.

The service template title in ITSI differs from the service_template value provided in fetch_services_spl in the itsi_service_import_flow_data.conf file. As a result, the service template wasn't linked to the service.

To resolve this issue, you can either update the service template title in ITSI or update the service_template value in the itsi_service_import_flow_data.conf file.

  1. Identify the service template title in ITSI:
    1. Open the itsi_service_import_flow_data.conf file for the content pack.
    2. In the dependencies_for_service_import/service_templates section, identify the key for the service template. For example, da-itsi-cp-cisco-data-center-cisco-nexus-fabric.
    3. Invoke the following GET REST API endpoint with the service template key. This API call returns a JSON payload that contains the service template title in ITSI.
      CODE 
      https://<host>:8089/servicesNS/nobody/SA-ITOA/itoa_interface/base_service_template/<service_template_key>
    4. In the JSON payload, identify the value for title. This is the service template title in ITSI.
      Example JSON payload:
      JSON 
      {"title": "Cisco Nexus Fabric", "description": "", "sec_grp": "default_itsi_security_group", "tags": [], "kpis": [{"title": "Capacity Anomalies", "description": "Count of anomalies for Capacity category", "entity_id_fields": "itsi_entity_id", "entity_breakdown_id_fields":
...}
  2. Identify the service_template value provided in fetch_services_spl in the itsi_service_import_flow_data.conf file.
    Example fetch_services_spl snippet in the itsi_service_import_flow_data.conf file:
    JSON 
    fetch_services_spl = search `cisco_dc_nd_index` sourcetype="cisco:dc:nd:fabrics" ownerCluster="{owner_cluster}" | dedup ownerCluster name | eval fabric_name=name, service_title=name, service_dependency=null(), service_template="Cisco Nexus Fabric"...
  3. Use either of the following options to align the service template title in ITSI with the service_template value in the itsi_service_import_flow_data.conf file:
    Option Description
    Change the service template title in ITSI to match the service_template value in the itsi_service_import_flow_data.conf file.
    1. From the ITSI main menu, select Configuration > Service Monitoring > Service Templates.

    2. Select the service template.

    3. Select the pencil icon to edit the service template title to match the service_template value you identified in step 2.
    Change the service_template value in the itsi_service_import_flow_data.conf file to match the service template title in ITSI.
    1. In the itsi_service_import_flow_data.conf file, update the service_template value in fetch_services_spl to match the title you identified in step 1.

    2. Restart Splunk Enterprise or reload the .conf file for the changes to take effect.
  4. If you already published the services, delete them:
    1. From the ITSI main menu, select Configuration > Service Monitoring > Service Templates.
    2. Check the boxes for the services.
    3. Select Bulk action > Delete
  5. Re-import the services to link them to the service template:
    1. From the ITSI main menu, select Configuration > Data Integrations.
    2. Select the Content library tab.
    3. Select your content pack.
    4. Select the Service import modules tab.
    5. Select and complete the service import module for the services you want to re-import.

Service has an entity rule with an empty value

Troubleshoot a published or unpublished service that has an incomplete entity rule.

This issue may affect published services as well as unpublished services viewed in the service sandbox.

When a service is selected on the Service and KPI management page or service sandbox, the Entities tab shows an entity rule with an empty value for matches.

The service template was updated and saved with the Overwrite entity rules setting enabled. This setting resets entity rules to have empty values.

  1. If you already published the services, delete them:
    1. From the ITSI main menu, select Configuration > Service Monitoring > Service Templates.
    2. Check the boxes for the services.
    3. Select Bulk action > Delete
  2. Re-import the services to link them to the service template:
    1. From the ITSI main menu, select Configuration > Data Integrations.
    2. Select the Content library tab.
    3. Select your content pack.
    4. Select the Service import modules tab.
    5. Select and complete the service import module for the services you want to re-import.

Service import module runs slowly or times out when loading services

Troubleshoot an slow or unresponsive service import module in a content pack.

On the service import module, the Select Services screen runs slowly or times out while loading the list of services that can be imported.

In the itsi_service_import_flow_data.conf file, the fetch_services_lookback parameter controls the time range for the search that fetches services. By default, this parameter is set to -7d (7 days). If you have a large volume of data, the default time range may affect search performance when fetching services in the service import module.

  1. Open the itsi_service_import_flow_data.conf file for the content pack.
  2. Adjust the fetch_services_lookback value to a shorter range. For example, you can change the value from -7d to -24h (last 24 hours).
  3. Restart Splunk Enterprise or reload the .conf file for the changes to take effect.