MyObservability

Entities in ITSI

An entity is an IT component that requires management to deliver an IT service. Each entity is uniquely identified by its specific attributes and relationships to other IT processes. Entities are usually hosts, but can also be items as diverse as cloud or virtual resources, network devices, applications, users, and cell towers.

Creating Entities

• Manually create a single entity in ITSI
• Manually import entities from a Splunk search in ITSI (Modules / Saved Searches / Ad hoc Searches)
• Manually import entities from a CSV file in ITSI

After you import entities, you can configure recurring imports to update existing entities and create new entities. Automatically create entities and collect data on a recurring basis with ITSI entity integrations. These integrations are available:

• Unix and Linux entity integration in ITSI
• Windows entity integration in ITSI
• VMware vSphere entity integration in ITSI
• Splunk Infrastructure Monitoring entity integration in ITSI

Note:

• All entities exist in the Global team.
• Only a user with write permissions to the Global team can create a single entity.
• Only a user with the itoa_admin role can import entities from CSV files or searches.

1. Create a single entity

Create a single entity in ITSI to associate events your Splunk platform deployment receives.

2. Import Entities from Splunk search

Create entities from Splunk ITSI module searches, saved searches, or ad hoc searches using indexed data coming in your Splunk platform deployment

Note: You can import a maximum of 50,000 entities at a time. If you attempt to import more than 50,000 entities, only the first 50,000 are imported.

3. Import entities from a CSV file

You can import entities from CSV files that contain one or more entity definitions.

Note: You can import a maximum of 50,000 entities at a time. If you attempt to import more than 50,000 entities, only the first 50,000 are imported.

ITSI Entity discovery searches

Splunk IT Service Intelligence (ITSI) includes saved searches that are enabled by default to discover your infrastructure’s entity data.

Include the index that you are sending data to as part of the itsi_im_metrics_indexes macro to use the entity discovery saved searches shipped with ITSI.If you are using a custom saved search in ITSI, update the macro to include the index that you are sending data to.

Generate pseudo entities

A pseudo entity in IT Service Intelligence (ITSI) is an entity automatically generated when you split a KPI by entities. It’s not a real entity because it has no ID and isn’t stored anywhere except in the itsi_summary index.

You create a pseudo entity if you split a KPI by entity but the entity split field isn’t matched in the entity lookup.

Set up a recurring import of entities

After you bulk import entities in Splunk IT Service Intelligence (ITSI), you can configure recurring imports to update existing entities and create new entities.