πŸ“‹ Overview

This guide walks through resolving a common ITSI installation issue where settings fail to import, specifically related to the missing Global Team model and permission errors.

🚨 Problem Description

Symptoms Observed:

1. ⚠️ Warning Messages on ITSI

  • Warnings appearing on the ITSI interface indicating that settings are not being imported properly.

2. πŸ“Š Internal Log Errors

  • Checking internal logs reveals errors such as:
    • “Team not found”
    • “Service settings not imported”

3. πŸ” Service Template Verification

  • Navigate to ITSI UI and attempt to access Service Templates to check services

4. ❌ Error Popup

  • System displays error: “Failed to fetch global team model”
  • Note: The Global Team model should be present by default with ITSI installation

5. πŸ‘₯ Missing Global Team

  • Go to Configure β†’ Teams
  • Global Team is not showing up, which triggers warnings

πŸ’‘ Important: The Global Team is a core component that should exist automatically after ITSI installation. Its absence indicates a configuration problem.

πŸ”§ Resolution Steps

6. πŸ“š Initial Troubleshooting Reference

Follow the official Splunk documentation for handling missing Global Teams:

πŸ“„ Documentation: ITSI Log Files – Splunk Docs

This documentation provides the initial steps for addressing team-related issues.

7. βš™οΈ First Attempt – Running Team Script

  • Execute the team import script as per documentation
  • Provide the required inputs when prompted
  • Result: Script fails to import team settings ❌

8. πŸ”Ž Root Cause Identification

  • Review internal logs for detailed error information
  • Error Found: "Access denied. You do not have permission to create this object"
  • This indicates a permissions issue with the current user role

9. πŸ” Permission Fix – Critical Step ⚠️

The solution requires admin role to inherit ITSI-specific roles from the ITSI app’s authorize.conf:

πŸ“„ Documentation: Access Denied Error Resolution

πŸ’­ Why This Happens: ITSI uses role-based access control that requires explicit role inheritance. Even though the admin role has broad system permissions, ITSI’s object creation requires specific inherited ITSI roles defined in authorize.conf.

10. πŸ‘€ Configure Admin Role Inheritance

  • Navigate to Splunk UI β†’ Settings β†’ Access Controls β†’ Roles
  • Locate and click Edit on the admin role
  • In the inheritance section, ensure admin inherits these ITSI roles:
    • itsi_admin
    • itsi_role
    • Any additional ITSI-specific roles listed in the app’s authorize.conf
  • Save the role configuration

11. πŸ”„ Re-execute Team Import

  • Follow steps 6 and 7 again
  • Run the team import script with required inputs
  • Result: Team settings import successfully this time βœ…

12. πŸ”ƒ Restart Splunk Services

  • Restart Splunk to apply all configuration changes:

13. βœ… Verification – Confirm Resolution

Access the Splunk ITSI UI and verify the following:

βœ… Warnings Cleared: No more import-related warnings on the dashboard

βœ… Service Templates Loading: Navigate to Service Templates – they now load without errors

βœ… Global Team Present: Go to Configure β†’ Teams – Global Team is now visible and accessible

🎯 Key Takeaways

  • πŸ”‘ Role Inheritance is Mandatory: Admin users must explicitly inherit ITSI-specific roles for proper functionality
  • πŸ‘₯ Global Team is Essential: This is a core ITSI component required for team-based configurations
  • ⚠️ Permission Errors During Setup: A common issue during initial installation or upgrades

πŸ“Œ Best Practices

  • ✏️ Pre-Installation: Review ITSI role requirements before installation
  • βœ”οΈ Post-Installation: Always verify admin role has proper ITSI role inheritance
  • πŸ” Regular Audits: Periodically check role configurations, especially after upgrades

πŸ› οΈ Troubleshooting Tips

If issues persist after following these steps:

  • πŸ“ Check itsi_import.log for detailed error messages
  • πŸ”„ Verify all ITSI services are running: $SPLUNK_HOME/bin/splunk status
  • πŸ’Ύ Ensure KV store is operational
  • πŸ“„ Review custom modifications to authorize.conf

πŸ“Œ Version Note: This solution applies to ITSI 4.12.0. Always refer to version-specific documentation for your ITSI installation.

If you are still facing an issue, feel free to Ask Doubts in the Comment Section Below and Don’t Forget to Follow us on πŸ‘Β Social Networks.

| Happy SplunkingΒ πŸ˜‰