📋 Overview

This guide walks through resolving a common ITSI installation issue where settings fail to import, specifically related to the missing Global Team model and permission errors.

🚨 Problem Description

Symptoms Observed:

1. ⚠️ Warning Messages on ITSI

  • Warnings appearing on the ITSI interface indicating that settings are not being imported properly.

2. 📊 Internal Log Errors

  • Checking internal logs reveals errors such as:
    • “Team not found”
    • “Service settings not imported”

3. 🔍 Service Template Verification

  • Navigate to ITSI UI and attempt to access Service Templates to check services

4. ❌ Error Popup

  • System displays error: “Failed to fetch global team model”
  • Note: The Global Team model should be present by default with ITSI installation

5. 👥 Missing Global Team

  • Go to Configure → Teams
  • Global Team is not showing up, which triggers warnings

💡 Important: The Global Team is a core component that should exist automatically after ITSI installation. Its absence indicates a configuration problem.

🔧 Resolution Steps

6. 📚 Initial Troubleshooting Reference

Follow the official Splunk documentation for handling missing Global Teams:

📄 Documentation: ITSI Log Files – Splunk Docs

This documentation provides the initial steps for addressing team-related issues.

7. ⚙️ First Attempt – Running Team Script

  • Execute the team import script as per documentation
  • Provide the required inputs when prompted
  • Result: Script fails to import team settings ❌

8. 🔎 Root Cause Identification

  • Review internal logs for detailed error information
  • Error Found: "Access denied. You do not have permission to create this object"
  • This indicates a permissions issue with the current user role

9. 🔐 Permission Fix – Critical Step ⚠️

The solution requires admin role to inherit ITSI-specific roles from the ITSI app’s authorize.conf:

📄 Documentation: Access Denied Error Resolution

💭 Why This Happens: ITSI uses role-based access control that requires explicit role inheritance. Even though the admin role has broad system permissions, ITSI’s object creation requires specific inherited ITSI roles defined in authorize.conf.

10. 👤 Configure Admin Role Inheritance

  • Navigate to Splunk UI → Settings → Access Controls → Roles
  • Locate and click Edit on the admin role
  • In the inheritance section, ensure admin inherits these ITSI roles:
    • itsi_admin
    • itsi_role
    • Any additional ITSI-specific roles listed in the app’s authorize.conf
  • Save the role configuration

11. 🔄 Re-execute Team Import

  • Follow steps 6 and 7 again
  • Run the team import script with required inputs
  • Result: Team settings import successfully this time ✅

12. 🔃 Restart Splunk Services

  • Restart Splunk to apply all configuration changes:

13. ✅ Verification – Confirm Resolution

Access the Splunk ITSI UI and verify the following:

✅ Warnings Cleared: No more import-related warnings on the dashboard

✅ Service Templates Loading: Navigate to Service Templates – they now load without errors

✅ Global Team Present: Go to Configure → Teams – Global Team is now visible and accessible

🎯 Key Takeaways

  • 🔑 Role Inheritance is Mandatory: Admin users must explicitly inherit ITSI-specific roles for proper functionality
  • 👥 Global Team is Essential: This is a core ITSI component required for team-based configurations
  • ⚠️ Permission Errors During Setup: A common issue during initial installation or upgrades

📌 Best Practices

  • ✏️ Pre-Installation: Review ITSI role requirements before installation
  • ✔️ Post-Installation: Always verify admin role has proper ITSI role inheritance
  • 🔍 Regular Audits: Periodically check role configurations, especially after upgrades

🛠️ Troubleshooting Tips

If issues persist after following these steps:

  • 📝 Check itsi_import.log for detailed error messages
  • 🔄 Verify all ITSI services are running: $SPLUNK_HOME/bin/splunk status
  • 💾 Ensure KV store is operational
  • 📄 Review custom modifications to authorize.conf

📌 Version Note: This solution applies to ITSI 4.12.0. Always refer to version-specific documentation for your ITSI installation.

If you are still facing an issue, feel free to Ask Doubts in the Comment Section Below and Don’t Forget to Follow us on 👍 Social Networks.

| Happy Splunking 😉