topic Re: Splunk ITSI Glass table data visualization issue in Dashboards & Visualizations

Splunk ITSI Glass table data visualization issue

Namdev — Thu, 19 Feb 2026 06:24:40 GMT

I have set up a distributed Splunk environment consisting of:

2 Forwarders
3 Indexers
1 Indexer Manager (Cluster Manager)
1 Deployment Server / License Manager / Monitoring Console
1 Search Head

I installed Splunk ITSI following the distributed deployment guidelines.

For testing purposes, I am ingesting data directly into the Search Head using HEC.
The data is successfully indexed and visible in ITSI. I have created several services and KPIs, and the KPI values are displaying correctly within ITSI.

However, when I create a Glass Table and map those KPIs to the visualization, no data appears on the Glass Table.

What could be causing the Glass Table to not display KPI data even though the KPIs themselves are populated?

Re: Splunk ITSI Glass table data visualization issue

gcusello — Thu, 19 Feb 2026 07:22:32 GMT

Hi @Namdev ,

what's the behavior: you don't have data or you see only a subset of them?

what's the search you used in the Glass table?

When I tried to display the ITSI data in a dashboard I built a lookup with the service decomposition and I used it to associate the kpi data from itsi_summary index to the services.

Ciao.

Giuseppe

Re: Splunk ITSI Glass table data visualization issue

Namdev — Fri, 20 Feb 2026 09:44:16 GMT

what's the search you used in the Glass table?

>>> I have not create any additional search query , I have created few services along with KPI.. and simple used Data source in Line chart. Expecting data should directly visible.

When I tried to display the ITSI data in a dashboard I built a lookup with the service decomposition and I used it to associate the kpi data from itsi_summary index to the services.

>> Can you elaborate this process.

Let me explain my scenario :

I am working on a use-case development task where I have created a network hierarchy.
At the base level, I added Mumbai router, Mumbai core, Bangalore router, and Bangalore core devices with KPIs such as CPU and memory usage.
Then I created separate Mumbai and Bangalore services — the Mumbai service is associated only with Mumbai devices, and the Bangalore service only with Bangalore devices — pulling the service health score.
Finally, I created a main network service at the top level that is associated with the location services.
Now I want to showcase the separate health status along with the KPIs and also display the cumulative health score at the top level

Re: Splunk ITSI Glass table data visualization issue

gcusello — Fri, 20 Feb 2026 13:10:08 GMT

Hi @Namdev ,

to work on Glass tables or dashboards you have to create a search the quesies the itsi_summary index to take the KPIs to display in the Glass Table.

But in the itsi_summary index, services are listed by serviceid and there isn't the service decomposition that you have to rebuild it using a search.

In other words, you have to run something like this (I don't know how many levels you have) to create a lookup that contains for all the services of your decomposition: serviceid and title:

Ciao.

Giuseppe