π Overview
This guide walks through resolving a common ITSI installation issue where settings fail to import, specifically related to the missing Global Team model and permission errors.
π¨ Problem Description
Symptoms Observed:
1. β οΈ Warning Messages on ITSI
- Warnings appearing on the ITSI interface indicating that settings are not being imported properly.
2. π Internal Log Errors
- Checking internal logs reveals errors such as:
- “Team not found”
- “Service settings not imported”
3. π Service Template Verification
- Navigate to ITSI UI and attempt to access Service Templates to check services
4. β Error Popup
- System displays error: “Failed to fetch global team model”
- Note: The Global Team model should be present by default with ITSI installation
5. π₯ Missing Global Team
- Go to Configure β Teams
- Global Team is not showing up, which triggers warnings
π‘ Important: The Global Team is a core component that should exist automatically after ITSI installation. Its absence indicates a configuration problem.
π§ Resolution Steps
6. π Initial Troubleshooting Reference
Follow the official Splunk documentation for handling missing Global Teams:
π Documentation: ITSI Log Files – Splunk Docs
This documentation provides the initial steps for addressing team-related issues.
7. βοΈ First Attempt – Running Team Script
- Execute the team import script as per documentation
- Provide the required inputs when prompted
- Result: Script fails to import team settings β
8. π Root Cause Identification
- Review internal logs for detailed error information
- Error Found:
"Access denied. You do not have permission to create this object"
- This indicates a permissions issue with the current user role
9. π Permission Fix – Critical Step β οΈ
The solution requires admin role to inherit ITSI-specific roles from the ITSI app’s authorize.conf
:
π Documentation: Access Denied Error Resolution
π Why This Happens: ITSI uses role-based access control that requires explicit role inheritance. Even though the admin role has broad system permissions, ITSI’s object creation requires specific inherited ITSI roles defined in authorize.conf
.
10. π€ Configure Admin Role Inheritance
- Navigate to Splunk UI β Settings β Access Controls β Roles
- Locate and click Edit on the admin role
- In the inheritance section, ensure admin inherits these ITSI roles:
itsi_admin
itsi_role
- Any additional ITSI-specific roles listed in the app’s
authorize.conf
- Save the role configuration
11. π Re-execute Team Import
- Follow steps 6 and 7 again
- Run the team import script with required inputs
- Result: Team settings import successfully this time β
12. π Restart Splunk Services
- Restart Splunk to apply all configuration changes:
13. β Verification – Confirm Resolution
Access the Splunk ITSI UI and verify the following:
β Warnings Cleared: No more import-related warnings on the dashboard
β Service Templates Loading: Navigate to Service Templates – they now load without errors
β Global Team Present: Go to Configure β Teams – Global Team is now visible and accessible
π― Key Takeaways
- π Role Inheritance is Mandatory: Admin users must explicitly inherit ITSI-specific roles for proper functionality
- π₯ Global Team is Essential: This is a core ITSI component required for team-based configurations
- β οΈ Permission Errors During Setup: A common issue during initial installation or upgrades
π Best Practices
- βοΈ Pre-Installation: Review ITSI role requirements before installation
- βοΈ Post-Installation: Always verify admin role has proper ITSI role inheritance
- π Regular Audits: Periodically check role configurations, especially after upgrades
π οΈ Troubleshooting Tips
If issues persist after following these steps:
- π Check
itsi_import.log
for detailed error messages - π Verify all ITSI services are running:
$SPLUNK_HOME/bin/splunk status
- πΎ Ensure KV store is operational
- π Review custom modifications to
authorize.conf
π Version Note: This solution applies to ITSI 4.12.0. Always refer to version-specific documentation for your ITSI installation.
| Happy SplunkingΒ π