MyObservability

Creating Service

Overview of creating services in ITSI

Services: Services is a collection of KPIs and entities that represents a real-world IT components and related to business goals.

Services can be

• Enabled / Disabled
• Change Teams
• Link to Service template
• Create Service Template
• Put in Maintenance Mode
• Depend on other services

Steps

• Creating new service
• Add entity rules
• Add KPIs
• Add service dependencies

Creating new service

• Create a single service in ITSI: Manually create a service from scratch or use service templates to automatically populate the entity rules and KPIs.
• Import service from a CSV: Import new services and link them to service templates from a CSV file.
• Import service from Search: Add services and link services to service templates from an ITSI module, saved search, or ad hoc search.

Create a single service in ITSI

Path: Login to ITSI -> Configuration -> Services -> Create Service.

3 ways you can create service

• Manually add the KPIs and entity rules.
• Link the service to a service template to automatically populate the KPIs and entity rules.
• Select prebuilt KPIs from ITSI modules to populate KPIs and entity rules.

Alternatively you can Clone a service: When you clone a service in ITSI, all entities, KPIs, and settings from the original service are cloned into the new service.

Import services from a CSV in ITSI

By bulk importing services from a CSV file rather than manually defining each service.

Types:

• Import services from csv
• Importing new services and linking them to service templates
• recurring service import from a CSV file (Through UF)
• Recurring service import from a Splunk search

Note:

• Don’t import more than 1,000 services with links to service templates. Only import 200-300 services with links to service templates at a time.
• ITSI uses the itsiimportobjects command to import services from a Splunk search or CSV file.
• All events that Splunk indexes from a service import are stored in the itsi_import_objects index.
• Each event has the itsi_import_objects:csv sourcetype.
• By default new services owned by Global.

Import services from csv

Steps:

• Create csv file (Ex: Service, Service description, Dependents services, Template link, application, app_title, host etc)
• Select “import from CSV”
• Select “Columns name” and select column from csv and “import column as” and select respective fields. Note: Exclude columns contain entities or entity rules. We can use them later in the import process.
• “Define entity rules” select a service template to complete the template entity rules

Recurring service import from a CSV file

• Create a recurring service import from data you store in a CSV file.
• You have to set up a universal forwarder on the system you store the CSV file to monitor the file and send data to your Splunk platform deployment, run an import from a Splunk search, and finally set up a recurring import from the Splunk search.

Import services from a search in ITSI

You can import multiple services from IT Service Intelligence (ITSI) module searches, saved searches, and ad hoc searches.

Entity Rules for a Service

Entity rules in IT Service Intelligence (ITSI) let you dynamically filter KPI searches based on entity alias matches, thereby associating one or more entities to a specific service.

• Entity rules are optional and you can add them at any time.
• You can use wildcards (*) as matching characters to filter entity rules to a subset of entities.

You can set up entity rules to match entities based on entity.

• aliases >
• info
• Entity title

• Entity type

• You can also create rules based on multiple AND/OR conditions.

Filters

• matches
• does not match
• matches a value to be defined in the service
• does not match a value to be defined in the service.

Filter entities

Use the “does not match” entity rule to filter entities out of a service rather than in. For example, if you want to filter out your database servers, you could add a rule such as “host does not match mysql*” so the KPI search does not run on those servers.

Service Dependencies in ITSI

• After you configure a service in IT Service Intelligence (ITSI), you can add other services as impacting services, or service dependencies.
• Impacting services have some sort of effect or influence on the primary service.
• They can help you detect if one service is having a negative impact on another service, and are useful when performing root cause analysis.

For example, you might have a web service that has a dependency on a database service.

Note: Avoid creating cyclic service dependencies. Cyclic dependencies can result in infinite loops or other unexpected results. A dotted line between services in the Service Analyzer tree view indicates a cyclic dependency.

Path: Login to ITSI -> Configuration -> Services -> Select Service -> Service Dependencies.

Service Health Score

• Backfill service health scores in ITSI.

Backfill service health scores in IT Service Intelligence (ITSI) to fill the summary indexes, itsi_summary and itsi_summary_metrics, with calculated historical service health scores. Backfill uses past KPI data, including dependent KPIs, to calculate service health scores for a given time period and populate the summary index.

Path: Login to ITSI -> Configuration -> Services -> Select Service -> Settings -> Backfill.

Add tags to a service in ITSI

• Add tags to provide more context when filtering your services and remediating issues.
• They provide a second layer of filtering in the Service Analyzer beyond services and KPIs.
• Tags act as soft links between services and templates, so removing or adding a tag to a linked service doesn’t unlink it from its template.

Rules

• You can’t add duplicate tags to a service.
• Tags are case insensitive, meaning you can’t add duplicate tags of different cases.
• Tags must be strings and can’t contain the following characters: / \ “ ‘ ! @ ? . , ; $ ^

Path: Login to ITSI -> Configuration -> Services -> Select Service -> Settings -> tags

---

Next Chapter: Service Analyser

---