topic Can I add and use ad hoc search KPI without entities? in Splunk ITSI

Can I add and use ad hoc search KPI without entities?

deodion — Thu, 28 Mar 2019 06:02:58 GMT

Can I add and use ad hoc search KPI without entities?

I have a service where I want to add a generic KPI and use ad hoc search, says like attached pic below,

I see that in Service Analyzer, the SSH Gateway KPI for SSH connection value is N/A, and it says 0 entities also.
I also tried to add host field at Split by Entity, Entity Filter Field, and Entity Alias Filtering, but no luck also,

Am I missing something? Thank you!

Re: Can I add and use ad hoc search KPI without entities?

sduff_splunk — Thu, 28 Mar 2019 10:21:42 GMT

It is not necessary to use entities with a KPI. You shouldn't need to worry about any of the Split by Entity, Entity Filter Field, and Entity Alias Filtering conditions.

I notice that your search uses stats, which is generally frowned upon when creating KPI searches. I believe that is what is causing your issue. Try the following search instead.

index=connectivity sourcetype=connect_ping | eval kpi_msg=if(action="connection succeeded", 100, 0)

Then use the latest kpi_msg as the aggregate value for the service.

Re: Can I add and use ad hoc search KPI without entities?

deodion — Tue, 02 Apr 2019 02:04:57 GMT

yes you are correct I found the answer after I post question anyway thanks!