Splunk IT Service Intelligence

ITSI configuration file - Management - itsi_team.conf

rijutha
Explorer

I am trying to administer ITSI using configuration files instead of creating and managing the configs on the UI.

To start off I try to configure a new team in the itsi_team.conf file under SA-ITOA app.

I created a copy of the itsi_team.conf under the local folder in the above app and updated the contents of the file with the below stanza.

[sample_itsi_security_group]
title = sample
description = Team for sample users
_immutable = 1
acl = {"owner":"nobody","read":["sample_viewonly"],"write":["itoa_admin"],"delete":["itoa_admin"]}

After this I restarted splunk. During the restart I get the below errors for every line in the above stanza:
Invalid key in stanza [sample_itsi_security_group] in /opt/splunk/etc/apps/SA-ITOA/local/itsi_team.conf, line 2: title (value: sample).
Invalid key in stanza [sample_itsi_security_group] in /opt/splunk/etc/apps/SA-ITOA/local/itsi_team.conf, line 3: description (value: Team for sample users).
Invalid key in stanza [sample_itsi_security_group] in /opt/splunk/etc/apps/SA-ITOA/local/itsi_team.conf, line 4: _immutable (value: 1).
Invalid key in stanza [sample_itsi_security_group] in /opt/splunk/etc/apps/SA-ITOA/local/itsi_team.conf, line 5: acl (value: {"owner":"nobody","read":["sample_viewonly"],"write":["itoa_admin"],"delete":["itoa_admin"]}).

Why am I getting these errors although I have followed the spec file to configure this?
Also I can see the team is created and the correct roles given the read and write access as per my config when I check on the UI, inspite of these errors thrown while restarting splunk.

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Hello @rijutha,

Your stanza name is incorrect, it should be default_itsi_security_group as per the documentation.
If you want to give a name you can give in property title.

0 Karma

rijutha
Explorer

But what if I want to create different teams? Multiple stanzas with the same name?

0 Karma

rijutha
Explorer

Also that did not create the team.

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

ITSI team information is stored in KVstore not in conf file. And as per the documentation itsi_team.conf is just to upload team information to KVstore, so once team is added to KVstore it is not used anymore.

0 Karma

rijutha
Explorer

Yes and my intention is also to upload the team confirguration to the KV Store which also means - to get the team created with the right acl values and have it listed under "Teams" in the ITSI UI.

But it does not happen when I have the stanza named as "default_itsi_security_group".

But it does get created when I have a different stanza name in this case - sample_itsi_security_group.

But i get the invalid key errors when I do this.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...