All Apps and Add-ons

How to create ITSI KPI for windows service status?

ansif
Motivator

How to create ITSI KPI for windows service status?

For Windows service I created a search like below:

eventtype=hostmon_windows Type=Service host="*" (Name="ClusSvc" OR Name="MSExchangeADTopology" OR Name="MSExchangeAntispamUpdate" OR Name="MSExchangeCompliance" OR Name="MSExchangeDagMgmt" OR Name="MSExchangeDelivery" OR Name="MSExchangeDiagnostics" OR Name="MSExchangeEdgeSync" OR Name="MSExchangeFastSearch" OR Name="MSExchangeFrontEndTransport" OR Name="MSExchangeHM" OR Name="MSExchangeHMRecovery" OR Name="MSExchangeImap4" OR Name="MSExchangeIMAP4BE" OR Name="MSExchangeIS" OR Name="MSExchangeMailboxAssistants" OR Name="MSExchangeMailboxReplication" OR Name="MSExchangePop3" OR Name="MSExchangePOP3BE" OR Name="MSExchangeRepl" OR Name="MSExchangeRPC" OR Name="MSExchangeServiceHost" OR Name="MSExchangeSubmission" OR Name="MSExchangeThrottling" OR Name="MSExchangeTransport" OR Name="MSExchangeTransportLogSearch" OR Name="MSExchangeUM" OR Name="MSExchangeUMCR" OR Name="COMSysApp" OR Name="Dnscache" OR Name="gpsvc" OR Name="HostControllerService" OR Name="IISADMIN" OR Name="LanmanServer" OR Name="LanmanWorkstation" OR Name="lmhosts" OR Name="LSM" OR Name="MpsSvc" OR Name="MSDTC" OR Name="MSMQ" OR Name="NcbService" OR Name="Netlogon" OR Name="Netman" OR Name="NetMsmqActivator" OR Name="NetPipeActivator" OR Name="netprofm" OR Name="NetTcpActivator" OR Name="NetTcpPortSharing" OR Name="ProfSvc" OR Name="RpcEptMapper" OR Name="RpcSs" OR Name="SamSs" OR Name="SessionEnv" OR Name="TermService" OR Name="W32Time" OR Name="W3SVC" OR Name="WAS" OR Name="Wcmsvc" OR Name="Winmgmt" OR Name="WinRM" OR Name="wmiApSrv" OR Name="WMSVC") StartMode="*" State="Stopped"

Threshold field as "Name"

It works only if any of the service is in stopped state since no event returns if all services are running.

Any suggestion on how to create a KPI in such scenario?

0 Karma
1 Solution

ansif
Motivator

@svemuric : The issue has been fixed by creating KPI itself. Attaching KPI settings for others who requires:

alt text

alt text

Treat Gap in data as Normal.

View solution in original post

0 Karma

ansif
Motivator

@svemuric : The issue has been fixed by creating KPI itself. Attaching KPI settings for others who requires:

alt text

alt text

Treat Gap in data as Normal.

0 Karma

KSinghK
Loves-to-Learn Lots

@ansif  this did not work for me. and I am running a pretty small search 

Index=* Type=Service Name= *BES* host=* StartMode=* State=Stopped. 

This works on normal search but when you add it to ITSI or create a KPi base search it stops working.

0 Karma

svemuric
Engager

Try with KPI Base searches create each service Name as a event using eval and add each service event as a Add Metrics define thresholds for each metric

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...