Awesome

Awesome ITSI

A curated list of awesome resources for Splunk IT Service Intelligence.

Contents

• Basics
• Education and Training
• Professional Services
• Modules
• Content Packs
• Notable Event Aggregation Policy
• Integrations
• .Conf Presentations

Basics

Resources for getting started with Splunk IT Service Intelligence.

• Splunk Website
  • Downloads
  • Previous Releases
  • Awesome Splunk - A curated list of awesome Splunk resources.
• Splunk ITSI
  • Splunkbase Entry - Download page for licensed users.
  • Documentation
  • Splunk Blog ITSI Posts

Education and Training

• Training Classes
  • Using IT Service Intelligence
  • Implementing IT Service Intelligence
• Certifications
  • Splunk ITSI Certified Admin
  • Splunk ITSI Admin Blueprint - A guide to the examinable material in the ITSI Admin certification.

Professional Services

Need to get the experts involved in an ITSI implementation, or seeing guidance.

• Splunk ITOA Professional Service Offerings
• Splunk Partners for ITSI Implementation

Modules

ITSI Module for Application Performance Monitoring

The Module for Application Performance Monitoring (APM) does not ship with ITSI by default. It can be downloaded from Splunkbase. If you are using ITSI on Splunk Cloud, request it to be installed from Splunk Cloud Ops.

Support Add-Ons

• Splunk Add-on for New Relic
• Splunk Add-on for AppDynamics

Application Server Module

Support Add-Ons

• Splunk Add-on for Tomcat
• Splunk Add-on for IBM WebSphere Application Server

Splunk ITSI Module for Continuous Delivery The Module for Continuous

The Splunk ITSI Module for Continuous Delivery does not shop with ITSI by default. It can be downloaded from Splunkbase. If you are using ITSI on Splunk Cloud, request it to be installed from Splunk Cloud Ops.

Support Add-Ons

• Splunk Add-on for Bamboo
• Splunk Add-on for JIRA
• Splunk App for Jenkins
• Splunk Plugin for Jenkins

Database Module

Support Add-Ons

• Splunk Add-on for Microsoft SQL Server
• Splunk Add-on for Oracle Database

End User Experience Monitoring Module

Support Add-Ons

• Splunk Add-on for MINT

Load Balancer Module

Support Add-Ons

• Splunk Add-on for F5 Big-IP
• Splunk Add-on for Citrix Netscaler

Operating System Module

Support Add-Ons

• Splunk Add-on for Unix and Linux
• Splunk Add-on for Microsoft Window

Storage Module

Support Add-Ons

• Splunk Add-on for NetApp Data ONTAP
• Splunk Add-on for EMC VNX

Virtualization Module

Support Add-Ons

• Splunk Add-on for Microsoft Hyper-V
• Splunk Add-on for VMware

Web Server Module

Support Add-Ons

• Splunk Add-on for Apache Web Server
• Splunk Add-on for Microsoft IIS

Content Packs

ITSI currently still supports modules. Modules were introduced in version 2.0 as a way to deliver out-of-the-box content to customers.

Like content packs, modules include KPI base searches, KPIs, and entity auto-discovery searches, but not the other elements that content packs provide. One key difference is that all module content is immutable, so you can't tailor KPI base searches for maximum performance.

Due to the limitations of modules, the current best practice is to use the content packs instead.

Further details on ITSI Content Packs can be found at https://docs.splunk.com/Documentation/ITSICP/current/Config/About

Content Pack for Monitoring Microsoft Windows

• Content Pack for Monitoring Microsoft Windows Download
• Documentation

Support Add-Ons

• Splunk Add-on for Microsoft Windows

Content Pack for Monitoring Unix and Linux

• Content Pack for Monitoring Unix and Linux Download
• Documentation

Support Add-Ons

• Splunk Add-on for Unix and Linux

Splunk ITSI Content Pack for Shared IT Infrastructure Components

• Content Pack for Shared IT Infrastructure Components Download
• Splunkbase Entry - Alternate download site on Splunkbase.
• Documentation

Support Add-Ons

• Splunk Add-on for Microsoft Windows
• Splunk Add-on for Unix and Linux

Notable Event Aggregation Policy

• A Blueprint for Splunk ITSI Alerting - A Splunk blog series by Jeff Wiedemann on developing a blueprint for enterprise-wide alerting.
  • Overview
  • Part 1
  • Part 2
  • Part 3
  • Part 4
  • Part 5

Integrations

• Phantom
  • Awesome Phantom
• VictorOps
  • Splunk Integration Guide - VictorOps - The VictorOps and Splunk integration allow teams to schedule queries or alerts in Splunk to monitor system health. The VictorOps integration with Splunk can be leveraged to collect data about the overall release tool chain and deployment success to allow teams to collaborate around that information in the timeline.
  • Create ticket in VictorOps - Splunk - You can create an incident in a VictorOps incident management system for an (ITSI) episode.

.Conf Presentations

Selected .conf presentations related to various aspects of ITSI.

• All .Conf Presentations for 'ITSI'
• Introduction to Splunk IT Service Intelligence - .conf16.
• Anatomy of a successful Splunk IT Service Intelligence Deployment - .conf17.
• Ready, Set, Go! Learn from others - The First 30 day Experiences of ITSI Customers - .conf17.
• The Splunk IT Service Intelligence (ITSI) Top 20 KPIs - .conf17.
• Faster Time to Value with ITSI Modules - .conf17.
• Anatomy of a successful Event Analytics Deployment - .conf18.

Contribute

Contributions welcome! Read the contribution guidelines first.

License

To the extent possible under law, Simon Duff has waived all copyright and related or neighbouring rights to this work.