Share data in Splunk IT Service Intelligence

When Splunk IT Service Intelligence is deployed on Splunk Enterprise, the Splunk platform sends usage data to Splunk Inc. ("Splunk") to help improve Splunk IT Service Intelligence in future releases. For information about how to opt in, and how the data is collected, stored, and governed, see Share data in Splunk Enterprise.

What data is collected

Splunk IT Service Intelligence collects the following basic usage information:

Component Description Example
app.ITSI.performanceMetrics Reports the time taken for a specific method to finish and non-identifiable supporting parameters to clean up the data (measured per 24 hours).
JSON 
{
   app: itsi
   component: app.ITSI.performanceMetrics
   data: {
     averageTime: 1.6168572306632996
     cumulativeTime: 6.467428922653198
     medianTime: 1.1328552961349487
     method: itoa_object.get_bulk
     numberOfObjects: 1012
     numberOfTransactions: 4
     p90Time: 2.975279831886292
   }
   deploymentID: 616ee3e9-532b-5b32-8679-0e58f7d3d336
   eventID: 9157E0BA-1A2A-48CC-A738-66AB5E5DEE33
   executionID: 38A07E6C-2CA7-4B6A-88DB-CB8ED52776D7
   optInRequired: 3
   timestamp: 1592906482
   type: aggregate
   visibility: [
     support
     anonymous
   ]
}
app.ITSI.entityTypes Reports the number of entities for each entity type (custom entity types are hashed).
JSON 
{
   app: itsi
   component: app.ITSI.entityTypes
   data: {
     countOfAssociatedEntities: 10
     entityTypeIds: a0745f7ed88cfac6058d1d4cfb57bc71127a28ad7c6756004142a90aab5ee99f
   }
   deploymentID: 417a2431-e14d-5550-b3dc-8d72442dc74a
   eventID: 51F77E4B-D866-49FB-B2F5-463258AC9FC7
   executionID: 661BB29D-A390-4B40-B17C-E5EFF48EE183
   optInRequired: 3
   timestamp: 1592820124
   type: aggregate
   visibility: [
     anonymous
     support
   ]
}
app.ITSI.entityTypeToEntityRatio Ratio of in-use entity types to entities.
JSON 
{
   app: itsi
   component: app.ITSI.entityTypeToEntityRatio
   data: {
     entityTypeToEntityRatio: 0.0007955449482895784
     numberOfEntities: 5028
     numberOfEntityTypes: 4
   }
   deploymentID: 616ee3e9-532b-5b32-8679-0e58f7d3d336
   eventID: BAC39F03-20BB-4D88-969F-072A9237581A
   executionID: 38A07E6C-2CA7-4B6A-88DB-CB8ED52776D7
   optInRequired: 3
   timestamp: 1592906593
   type: aggregate
   visibility: [
     support
     anonymous
   ]
}
app.ITSI.serviceToEntityRatio Reports the ratio of in-use services to entities.
JSON 
{
   app: itsi
   component: app.ITSI.serviceToEntityRatio
   data: {
     numberOfEntities: 128
     numberOfServices: 8
     serviceToEntityRatio: 0.0625
   }
   deploymentID: 639ae7f7-0af0-5a0f-b053-65a3662f230a
   eventID: 6A71F467-B4FE-4D4C-99F4-4F324DD01B72
   executionID: EC2EE972-58C2-441F-97B9-8921453AC341
   optInRequired: 3
   timestamp: 1592820188
   type: aggregate
   visibility: [
     anonymous
     support
   ]
}
app.ITSI.kpiToEntityRatio Reports the ratio of in-use KPIs to entities.
JSON 
{
   app: itsi
   component: app.ITSI.kpiToEntityRatio
   data: {
     kpiToEntityRatio: 0.20689655172413793
     numberOfEntities: 87
     numberOfKpis: 18
   }
   deploymentID: 121370bf-b9ce-54c5-96e0-f99a03242ef5
   eventID: 3341F59D-8290-4683-B4A9-3F7C09458CB3
   executionID: CC1CAA21-78DD-46C5-BEAA-5BFD690100E3
   optInRequired: 3
   timestamp: 1592733807
   type: aggregate
   visibility: [
     anonymous
     support
   ]
}
app.ITSI.sharedBaseSearchToEntityRatio Reports the ratio of in-use shared base searches to entities.
JSON 
{
   app: itsi
   component: app.ITSI.sharedBaseSearchToEntityRatio
   data: {
     numberOfEntities: 25080
     numberOfSharedBaseSearches: 5
     sharedBaseSearchToEntityRatio: 0.00019936204146730463
   }
   deploymentID: 616ee3e9-532b-5b32-8679-0e58f7d3d336
   eventID: 8F418716-926D-4D67-B31A-3732DBC4EC21
   executionID: 38A07E6C-2CA7-4B6A-88DB-CB8ED52776D7
   optInRequired: 3
   timestamp: 1592906664
   type: aggregate
   visibility: [
     support
     anonymous
   ]
}
app.ITSI.serviceAssociatedEntityToServiceUnassociatedEntityRatio Reports the number of entities by service association.
JSON 
{
   app: itsi
   component: app.ITSI.serviceAssociatedEntityToServiceUnassociatedEntityRatio
   data: {
     numberOfServiceAssociatedEntities: 5016
     numberOfServiceUnassociatedEntities: 12
     serviceAssociatedEntityToServiceUnassociatedEntityRatio: 418
   }
   deploymentID: 616ee3e9-532b-5b32-8679-0e58f7d3d336
   eventID: 965EC96C-33E4-44E2-B885-77CE071D3EEC
   executionID: 38A07E6C-2CA7-4B6A-88DB-CB8ED52776D7
   optInRequired: 3
   timestamp: 1592906664
   type: aggregate
   visibility: [
     anonymous
     support
   ]
}
app.session.ITSI.pageLoad Reports the time taken for a React component to load with associated metadata.
JSON 
{
   component: app.session.ITSI.pageLoad
   data: {
     app: itsi
     loadTime: 18398.775000008754
     metadata: {
       activeTabId: EVENT_DATA_SEARCH
       isInitialAppMount: true
     }
     mode: development
     page: entity_detail
   }
   deploymentID: 2b623070-88c3-51a2-bed6-8dd666600c60
   eventID: 768b9773-57c9-9549-5527-9346c7568899
   experienceID: 8268d610-95d7-5a6d-4e3e-c5ad9f561a5b
   optInRequired: 3
   timestamp: 1592356630
   userID: 5f4dba230c6b7e300aec79ea85261914c069f777452a207f26b56fb185892b27
   version: 4
   visibility: anonymous,support
}
app.session.pageView Reports the pages a user has visited.
JSON 
{
   component: app.session.pageview
   data: {
     app: itsi
     page: notable_event_aggregation_policy_detail_view
   }
   deploymentID: 0e55c2be-a373-5e5f-b9cf-34f0977566e1
   eventID: e4df5657-d13f-8f66-3958-21f0e4247439
   experienceID: 6cac0958-68e6-5a3b-631a-c7f407794280
   optInRequired: 3
   timestamp: 1592850392
   userID: 36966f73a802b0f3e37b385983f3d21d556b0c9d5e2e4bcd9163526bafe12320
   version: 4
   visibility: anonymous,support
}
app.session.udf.telemetry Reports information about visualizations and configurations that users implement in beta glass tables.
JSON 
component: app.session.udf.telemetry
   data: { [-]
     app: itsi
     definition: { [-]
       inputs: { [-]
         input1: { [-]
           options: { [-]
             items: 3
           }
           titleLength: 6
           type: input.dropdown
         }
       }
       layout: { [-]
         globalInputs: [ [-]
           input1
         ]
         options: { [-]
           height: 750
           width: 1300
         }
         structure: [ [-]
           { [-]
             item: viz_eGQh2uAJ
             position: { [-]
               h: 730
               w: 1280
               x: 10
               y: 10
             }
             type: block
           }
           { [-]
             item: viz_2WcVmXz0
             position: { [-]
               h: 450
               w: 770
               x: 260
               y: 20
             }
             type: block
         ]
         type: absolute
       }
       titleLength: 26
       visualizations: { [-]
         viz_2WcVmXz0: { [-]
           options: { [-]
             preserveAspectRatio: true
             src: true
           }
           type: viz.img
         }
         viz_5HKW2R1q: { [-]
           options: { [-]
             legend.placement: top
           }
           titleLength: 29
           type: viz.line
         }
       }
     }
     definitionInfo: { [-]
       componentCounts: { [-]
         dataSourceTypeCounts: { [-]
           ds.test: 11
         }
         inputTypeCounts: { [-]
           input.dropdown: 1
         }
         vizTypeCounts: { [-]
           abslayout.line: 6
           viz.img: 1
           viz.line: 2
           viz.rectangle: 1
           viz.singlevalue: 8
           viz.table: 1
           viz.text: 3
         }
       }
       numDataSources: 11
       numInputs: 1
       numViz: 22
     }
     page: boston_marathon__absolute__k0wxyjod/edit
     pageAction: dashboard.initialize
     udfVersion: 5.2.0
   }
   deploymentID: e5fc210a-8e27-54b6-b50e-306304917a3f
   eventID: 40c251b1-09ad-cb2d-cb64-c503c8e91695
   experienceID: 10fa783d-65c5-0ece-9808-416f92ccfd48
   timestamp: 1569281682
   userID: 0b9a7eef9855fe028ae96a4eeea30356bdd66dfeeae10002503a6e7dd9be0e92
   version: 3
   visibility: anonymous,support
app.ITSI.entityLifecycleManagement Number of entity lifecycle management policies having auto retire feature enabled on the Splunk system.
JSON 
{
   "timestamp":1648091047,
   "component":"app.ITSI.entityLifecycleManagement",
   "executionID":"64FB8F4D-5BB9-4D0E-9549-5E5FFFD883C8",
   "data":{
      "countOfRetirableEntities":0,
      "countOfEntityTypesUnderManagement":3,
      "countOfDisabledEntityManagementPolicies":9,
      "countOfEnabledEntityManagementPolicies":1,
      "countOfEntitiesUnderManagement":2,
      "countOfRetiredEntities":2,
      "countOfAutoRetireEntityManagementPolicies":1,
      "avgPolicyRunTime":4.65,
      "avgPolicyLookbackPeriod":26
   },
   "optInRequired":3,
   "visibility":[
      "anonymous",
      "support"
   ],
   "eventID":"0F66ABC6-83C4-4CD2-B762-415D2B2474DD",
   "type":"aggregate",
   "deploymentID":"91182b71-8c10-5019-8daa-6722bac9bc27",
   "app":"itsi"
}
app.ITSI.calculationWindowUsage Information about the types of calculation windows in ITSI.
JSON 
{
   app: itsi
   component: app.ITSI.calculationWindowUsage
   data: {
     customWindow: {
       calculationWindowValueCount: [
         {
           calculationWindowValue: 33
           count: 1
         }
       ]
       totalCount: 1
     }
     predefinedWindow: {
       calculationWindowValueCount: [
         {
           calculationWindowValue: 5
           count: 8
         }
       ]
       totalCount: 8
     }
   }
   deploymentID: a3b9b625-8392-5205-b4e8-350dd0491cbb
   eventID: 4ECEA390-74EB-48CF-B387-3808D68A7A3B
   executionID: 110B8DAD-B7F2-4E8B-8CB2-43390A8A253A
   optInRequired: 3
   timestamp: 1665082511
   type: aggregate
   visibility: [
     anonymous
     support
   ]
}
app.ITSI.knowledgeObjectsCounts Provides a count of various knowledge objects in ITSI.
JSON 
{
   "data":{
      "knowledgeObjects":{
         "authoredContentPacks": {
            "totalCount": 1
            },
         "eventManagementStates":{
            "totalCount":6,
            "privateCount":0,
            "publicCount":6
         },
         "glassTables":{
            "privateCount":0,
            "publicCount":2,
            "totalCount":2
         },
         "contentPacks":{
            "totalCount":1,
            "DA-ITSI-CP-CUST-63929313c0755967941cb2cd":1
         },
         "services":{
            "kpis":{
               "adhocCount":2,
               "totalCount":1013,
               "sharedBaseSearchCount":1011,
               "dataModelCount":0,
               "metricsCount":0
            },
            "dependServicesCount":86,
            "servicesLinkedToATemplate":96,
            "totalCount":96,
            "servicesNotInGlobal":2
         },
         "deepDives":{
            "publicCount":1,
            "privateCount":1,
            "totalCount":2
         },
         "correlationSearches":{
            "totalCount":7
         },
         "maintenanceWindows":{
            "totalCount":0
         },
         "homeViews":{
            "privateCount":0,
            "totalCount":11,
            "publicCount":11
         },
         "entityManagementRules":{
            "totalCount":1
         },
         "kpiBaseSearches":{
            "totalCount":99
         },
         "entityManagementPolicies":{
            "totalCount":0
         },
         "authoredContentPacks":{
            "totalCount":1
         },
         "entityTypes":{
            "totalCount":10
         },
         "entities":{
            "totalCount":2216
         },
         "kpiTemplates":{
            "totalCount":33
         },
         "notableEventAggregationPolicies":{
            "totalCount":6
         },
         "customThresholdWindows":{
            "totalCount":0
         },
         "kpiThresholdTemplates":{
            "totalCount":36
         },
         "teams":{
            "totalCount":5
         },
         "serviceTemplates":{
            "totalCount":10
         }
      }
   }
}
app.ITSI.ATUsage Provides a count of KPIs with thresholds generated by Splunk AI, and services using adaptive thresholding or using KPIs that have thresholds generated by Splunk AI.
JSON 
{
  "timestamp": 1633320026,
  "component": "app.ITSI.ATUsage",
  "executionID": "ECF66CEF-00EC-4EB3-817A-C0CF6A24C24F",
  "data": {
        "kpis_using_at": 170,
        "kpis_using_policies": {
            "percentage": 4,
            "stdev": 124,
            "static": 51,
            "range": 1,
            "quantile": 3
        },
        "kpis_using_threshold_templates": {
            "kpi_threshold_template_3_stdev": 104,
            "kpi_threshold_template_3_quantile": 2,
            "kpi_threshold_template_2_stdev": 2,
            "kpi_threshold_template_8_stdev": 1
        },
        "kpis_using_custom_thresholds": 61,
        "kpis_using_recommendation": 0,
        "kpis_with_recommendations_modified": 0,
        "services_using_at": 117,
        "services_using_custom_thresholds": 16,
        "services_using_recommendation": 0,
        "services_with_recommendations_modified": 0,
        "min_threshold_level": {
            "percentage": 0,
            "stdev": -12.18,
            "range": 0,
            "quantile": 0
        },
        "max_threshold_level": {
            "percentage": 90,
            "stdev": 12.18,
            "range": 0.75,
            "quantile": 0.97
        }
    },
  "optInRequired": 3,
  "visibility": [
    "anonymous",
    "support"
  ],
  "eventID": "FAA1804F-F2C5-47A1-B06B-DED1CB31F252",
  "type": "aggregate",
  "deploymentID": "91182b71-8c10-5019-8daa-6722bac9bc27",
  "app": "itsi"
}
app.session.ITSI.componentInteraction Tracks user interactions with various UI elements to understand how users accomplish a specific goal.
JSON 
{
    "optInRequired":3,
    "visibility":"anonymous,support",
    "experienceID":"166287aa-3c8d-fdd0-a17f-90aa0fe39596",
    "version":"4",
    "timestamp":1691621685,
    "data":{
        "itsiComponent":"ServiceSandbox",
        "page":"service_sandbox",
        "action":"Save",
        "app":"itsi",
        "numberOfChangesApplied":2
    },
    "splunkVersion":"9.0.0",
    "component":"app.session.ITSI.componentInteraction",
    "eventID":"1f4f5b55-55f7-fb0a-3559-b1cfe78b0734",
    "deploymentID":"68058ae0-9a56-55f0-bf4b-dd603e22c7aa",
    "original_timestamp":1691621685,
    "original_event_id":"76e9282e78b0fc8cec7a2a6358967360d6638f54f4abab8a1770aea10d1d5a3e",
    "userID":"28586f93ca33c3ae5365473820acf0230abdcb1481e955eea288a99291d81bd4"
}
app.ITSI.performanceMetrics Measures amount of time taken by specific backend functions.
JSON 
{
   app: itsi
   component: app.ITSI.performanceMetrics
   data: {
     averageTime: 0.01605749130249
     cumulativeTime: 0.03211498260498
     medianTime: 0.01605749130249
     method: validate_sandbox
     numberOfTransactions: 2
     p90Time: 0.016411876678467
   }
   deploymentID: e950e291-0ffc-5b55-9435-c43caa398d95
   eventID: 78D10842-382A-4A2D-9970-CDE81F738FBE
   executionID: 15BEDE8E-6FEC-4C3C-9C17-42E18448157D
   optInRequired: 3
   original_event_id: d9407d4db9c3aed0194d5ef4fd5c5bceb28097e5088d154f0f0c29cb713746e5
   original_timestamp: 1696363278
   timestamp: 1696363278
   type: aggregate
   visibility: [
     anonymous
     support
   ]
}
app.ITSI.entityDiscoverySearchCleanupCommand Information about when the CleanupEntityDiscoverySearches command is used.
JSON 
{
   app: itsi
   component: app.ITSI.entityDiscoverySearchCleanupCommand
   data: {
     cleaned_entities: 5
     end_time_int: 1696343197.1711
     has_error: 0
     host: ash-vm1
     roles_for_current_user: ['admin']
     start_time_int: 1696343195.432
     tid: db50487861f811eeb32c00505696f8f7
   }
   deploymentID: 7e475054-ba16-51d7-8ea5-c5a7856b6e64
   eventID: 585DDA3D-7EDB-4378-B2DA-1DD9DC606E1C
   executionID: 8C7FFB2E-2FE6-491A-96F2-D15EAD14FCB7
   optInRequired: 3
   original_event_id: ecfe876186665569e1223b1373f223bcacd22593992bf179ff4a44780f2890e5
   original_timestamp: 1696384807
   timestamp: 1696384807
   type: aggregate
   visibility: [
     anonymous
     support
   ]
}