Overview of content pack management in ITSI
Install and manage content packs based on your organization's specific use cases. Content packs provide pre-configured objects to help you quickly get started using Splunk IT Service Intelligence (ITSI) to manage alerts, entities, or services from similar data sources, as well as adopt more advanced monitoring capabilities.
About the content library
On the Data Integrations page, the Content library tab lists pre-installed content packs and user-generated content packs.
Only content packs that have ITEW/ITSI objects or saved searches are visible on this page. For example, a content pack consisting only of Splunk Enterprise objects and no saved searches will not be visible on this page.
If the content pack includes saved searches, the content pack tile lists the status of the searches. Saved search status can be one of the following states:
- All Saved Searches activated: This text displays if all the saved searches of the content pack are activated.
- All Saved Searches deactivated: This text displays if all the saved searches of the content pack are deactivated.
- X/Y Saved Searches deactivated: This text displays when some of the saved searches are deactivated, where X is the number of saved searches in a deactivated state and Y is the total number of saved searches in the content pack.
Prerequisites
| Requirement | Description |
|---|---|
| Roles | You must have the admin or itoa_admin role to create content packs. Enable the install_apps and edit_local_apps capabilities to install content packs. For more information, see Configure users and roles in ITSI in the Administration Manual. |
Steps
Step 1: Install a content pack
Follow the steps below to install a content pack in ITSI:
- From the ITSI navigation menu, select Configuration then Data Integrations then the Content Library tab. View the list of all available content packs and their current status (installed or uninstalled).
- Select content pack you want to install to begin the guided content pack installation workflow. Review the list of knowledge objects included in the content pack, confirm that you want to install these objects, and select Next to continue.
Step 2: (Optional) Import objects as enabled
Turn on the Import as enabled toggle to immediately activate the knowledge objects included in your content pack. This setting only applies to services, correlation searches, and aggregation policies. Generally, it is not recommended to import objects as enabled in order to avoid breaking existing configurations. Other objects in your content pack are enabled by default.Step 3: (Optional) Set a prefix
Enter a prefix string (for example, PROD_) to add at the beginning of all object titles. A prefix helps distinguish content pack objects from other ITSI custom objects.
Step 4: (Optional) Backfill service KPIs
If the content pack includes services, select the Backfill service KPIs option to populate services with historic KPI data. Disable the backfill if you don't need the historical data. This step only applies if you select a content pack containing services.
Step 5: (Optional) Install services using service module
Use the service import module (a section below the list of knowledge objects for your content pack) to import services for content packs which include services.
Track installation status
From the ITSI main menu, select Messages. When a content pack installation starts, fails, or succeeds, a message appears with a link to view the logs for the process.
Dashboards
For dashboards, custom visualizations are referenced using the image's Base-64 encoding in the dashboard's JSON source code. Custom visualizations stored locally on your system will have the image's static path URL automatically updated for the content pack. In search head cluster environments, ensure the search head on which the content pack is built has the locally stored file.
Additionally, saved searches used as data sources for the content pack's dashboard(s) are automatically added. Private saved searches won't be included. When the content pack is built, the saved search's app name in the dashboard will be replaced with the content pack's ID.