Import external maintenance windows

Import maintenance windows applied to objects from external data sources into ITSI.

You can import maintenance windows from external data sources to Splunk IT Service Intelligence (ITSI), preventing unnecessary alerts and reducing alert fatigue. ITSI supports the following methods for importing your outage data:

  • Generic outage: A scheduled integration used for external data sources, or specific ServiceNow tables (such as Change Requests) that require manual field mapping.

  • CSV import: A manual import using a CSV file or a Splunk search to generate maintenance windows without setting up a recurring schedule. CSV import can only be completed for external configuration objects (CIs).

  • Out-of-the-box (OOTB) ServiceNow outage integration: A pre-configured integration designed to integrate outage records directly from ServiceNow using default field mappings.

Import maintenance windows using a generic outage integration

Use a generic outage integration to automatically import maintenance windows from any management system into ITSI. Create maintenance windows from your external outage data and suppress actions during planned downtime, reducing duplicate efforts across multiple platforms.

Additionally, you can also suppress an episode action rule from executing if any CI associated when the episode is in maintenance mode by configuring an action rule in a notable event aggregation policy.

  • Your external outage data is ingested into Splunk. Configure the appropriate technology add-on or HEC input so that outage records are indexed and searchable.

  • Check that the External CI maintenance windows feature flag is toggled on from the Configuration Assistant, then the Advanced configuration button.

  • You need itoa_admin or itoa_team_admin to create or edit integrations.

  1. In ITSI, go to Configuration then Data Integrations then Integrations Library, then go to the Maintenance/Outages section.
  2. Select Generic Outage.
  3. Select Add integration.
  4. Configure the base search to query your outage data. For example: index="your_index" sourcetype="your_outage_sourcetype".
  5. Set the search time range.
  6. Set the schedule to control how often ITSI checks for new or updated outage records.
  7. Map your source fields to the required ITSI maintenance window fields:
    1. Title: Name of the maintenance window.
    2. Start time: Maps to source start datetime field. When the maintenance window begins. CSV accepts YYYY-MM-DD HH:mm format that ITSI converts.
    3. CI ID: Comma-separated list of CI identifiers. During import, each ID is resolved against the itsi_ci_information KV Store collection and must match. Each matching CI is stored as an object with _key, ci_id, and object_type: "external_ci".
    4. Import source: Text field, the default value is Generic.
    5. Outage ID: unique identifier of the record in the external source system.
    6. End time: When maintenance period ends.
  8. (Optional) Map additional fields such as end time, duration, time zone, and recurrence.
  9. Select Save.
When maintenance windows are ingested into ITSI, an alert is generated whenever a CI enters a maintenance window, and another alert is generated when the maintenance window ends. These maintenance window alerts can also be correlated into an episode, allowing you to identify whether any CI associated with the episode was under maintenance.