SPLK-3002 Installing and Configuring ITSI

Installing and Configuring ITSI Detailed Explanation

1. Overview – What Does It Mean to "Install ITSI"?

Installing ITSI means setting up the Splunk IT Service Intelligence app so that your Splunk system can:

• Collect KPI data

• Create services and dashboards

• Analyze IT health in real time

• Detect issues and trigger alerts

Think of it like building the foundation of a house: before you can use ITSI to monitor and visualize your environment, you need to install and configure it properly.

2. What You Need Before You Begin

Before you can install ITSI, make sure your system is ready. Here are the basic requirements:

a. Splunk Enterprise (Version 8.0 or Higher)

• ITSI runs on top of Splunk Enterprise.

• Make sure your Splunk environment is healthy, with good performance and search capability.

b. ITSI App Package (.spl)

• You can download this from Splunkbase.

• It comes as a .spl file (Splunk’s package format).

c. Admin Privileges

• You’ll need to be a Splunk admin to install ITSI and make configuration changes.

d. Adequate System Resources

• ITSI needs more power than basic Splunk apps:

  • RAM: Ideally 16 GB or more

  • CPU: Multiple cores recommended

  • Disk I/O: Fast disk for data indexing and acceleration

• Why? Because ITSI runs many background searches and visual dashboards.

e. ITSI License

• ITSI has a separate license from Splunk Enterprise.

• Make sure it’s active and installed, or you won’t be able to use all the features.

3. Step-by-Step – How to Install ITSI

Here’s how to get ITSI up and running:

Step 1: Download the ITSI App

• Go to Splunkbase.

• Search for “ITSI” or “Splunk IT Service Intelligence”.

• Download the .spl file.

Step 2: Install the App

You have two choices:

• Splunk UI Method:

  • Go to Apps > Manage Apps > Install app from file

  • Upload the .spl file and restart Splunk

• Command Line Method:

  • Place the .spl file in your $SPLUNK_HOME/etc/apps directory

  • Unpack it

  • Restart Splunk with splunk restart

Step 3: Configure Required Indexes

You need to create several indexes that ITSI uses for its operations:

• itsi_summary – stores KPI results and health scores

• itsi_tracked_alerts – stores notable events

• itsi_grouped_alerts – stores grouped event data

• Make sure these indexes are included in your index configuration

Step 4: Set Up Modular Inputs

Modular inputs are used to:

• Collect internal ITSI logs

• Gather data from other sources

• Support automation (like service templates, alert actions)

These can be configured through the UI after installation.

Step 5: Perform a System Health Check

Once everything is installed:

• Use the ITSI Health Check dashboard to verify your environment

• Look for any missing permissions, misconfigured indexes, or failed searches

This step ensures your ITSI system is ready and stable.

4. Post-Installation Configuration

Once ITSI is installed, there are a few important steps to take before you start building services:

Configure Service Accounts and Teams

• Create ITSI Teams that represent different groups in your organization (e.g., “Network Ops”, “App Dev”).

• Assign users and roles to each team based on what services they manage.

Set Up Data Onboarding Pipelines

• Ensure that your KPIs have access to reliable, timely data.

• Ingest logs, metrics, and performance data from servers, apps, and cloud services.

Enable Data Models and Acceleration (Optional but Recommended)

• Enable data model acceleration for performance improvement in searches and dashboards.

• Note: This uses more storage but speeds up your analysis.

Summary: What to Remember About Installing and Configuring ITSI

• ITSI must be installed on top of a working Splunk Enterprise system.

• You need to have the app package, admin access, and an ITSI license.

• After installation, configure indexes, modular inputs, and health checks.

• Before using ITSI, finish setup with teams, data onboarding, and performance tuning.

Installing and Configuring ITSI (Additional Content)

1. Version Upgrade Considerations

Why it matters:
Many users are upgrading from an earlier version of ITSI rather than performing a clean install. Understanding versioning differences and upgrade steps is important for both administrators and exam preparation.

Suggested Addition:

When upgrading an existing ITSI installation:

• Always review the release notes for breaking changes and deprecated features.

• Use the Upgrade Readiness Dashboard in ITSI to detect incompatible configurations.

• Back up:

  • The $SPLUNK_HOME/etc/apps/SA-ITOA/ directory

  • Key ITSI-related indexes such as itsi_summary

Key differences between a fresh install and an upgrade:

• Upgrades preserve existing data, services, and KPIs

• Clean installs start with default configuration templates, without any prior service or team configuration

Pro tip: Always perform the upgrade in a staging environment first.

2. FAQ-Style Installation Troubleshooting Tips

Why it matters:
Real-world installations often encounter small issues that delay setup. Offering quick answers in a “FAQ” format boosts student preparedness.

Sample FAQ Enhancements:

• Q: Why don’t my ITSI indexes (like itsi_summary) appear after installation?
  A: They must be manually created if not automatically provisioned. Check indexes.conf or run | eventcount summarize=false index=* to verify.

• Q: Why does the system say my license is invalid?
  A: ITSI requires a separate premium license. Ensure the .lic file has been uploaded via License Manager, and that it’s not expired.

• Q: Installation seems complete, but I can’t access the Service Analyzer.
  A: Confirm that:

  • The itsi app is enabled (Manage Apps)

  • Your role has the correct capabilities (like itsi_admin)

3. Configuration Paths and Log Directories

Why it matters:
Knowing where ITSI writes its data helps with debugging, auditing, and maintenance.

Suggested Explanation:

Important file system paths related to ITSI:

• Configuration Directory:
  $SPLUNK_HOME/etc/apps/SA-ITOA/
  Contains core configuration files, dashboards, and saved searches.

• Log Directory:
  $SPLUNK_HOME/var/log/itsi/
  Includes logs for internal ITSI activity, correlation searches, and error tracking.

Useful log files:

• itsi_troubleshooting.log – Troubleshooting toolkit logs

• itsi_scheduler.log – Information about scheduled KPI jobs

• itsi_summary_indexing.log – Summary index population status

Pro tip: Add log monitoring for this directory to catch problems early.

Summary

These enhancements:

• Help learners bridge the gap between conceptual knowledge and practical deployment

• Prepare students for real-world installations and maintenance tasks

• Encourage proactive troubleshooting through log awareness and configuration management