topic Re: Splunk ITSI create KPI with text value or state value in Splunk ITSI

Splunk ITSI create KPI with text value or state value

deodion — Thu, 28 Mar 2019 04:55:07 GMT

I use Splunk TA-Connectivity,
I have a search that test internet connection by using below search, the event shows pinging the url is successful:

index=connectivity sourcetype=webping url="*google*" 
| stats values(url) latest(description) AS status latest(action) AS action by url 
| fields url status action

Is there any way to use this as Splunk ITSI KPI?
What is the best way to incorporate text based value into KPI?

May be I simply adjust the search like below?

index=connectivity sourcetype=webping url="*detik*" OR url="*google*"
| stats values(url) latest(description) AS status latest(action) AS action by url 
| fields url status action
| eval kpi_status = if(status == online, 100, 0)

So I simply use kpi_status field as the Threshold Field,

any other better ways? Thanks!!

Re: Splunk ITSI create KPI with text value or state value

sduff_splunk — Thu, 28 Mar 2019 10:24:52 GMT

As per your other question, try not to use stats in your KPI queries, you don't need it.

index=connectivity sourcetype=webping url="*detik*" OR url="*google*" | eval kpi_msg=if(status="online", 100, 0)

Will you split the KPI by the url field? Have you considered how you want to combine that to indicate the aggregate health of the service?

Re: Splunk ITSI create KPI with text value or state value

deodion — Tue, 02 Apr 2019 02:03:56 GMT

yes you are correct I found the answer after I post question anyway thanks!