All Apps and Add-ons

ITSI: two KPIS with critical severity not working


Hello all,

I am trying to configure a service in ITSI with two KPIS ("A", "B") with the most severity (11).

When I do the test inside the configuration of the service it works perfectly, if any of these KPIS get critical status, global health score of the service gets 0 (critical).

But in the practice, when the service is running with real data, only when "A" gets critical, global health score of the service changes to critical, but it does not happens with "B". I seems that system gives more importance to "A" than "B".

I would like to ask if someone is facing the same issue, if someone knows that this is a real limitation of ITSI (although in testing mode when setting configuration of service it works well) and if someone has a solution for this.

Thanks very much in advance for the help,

0 Karma


Hello @jaimelopez

Aside from both A and B's KPI Importance value set to 11, may I know if you've set entities on them and what are the thresholds of A and B KPI?

While the condition on "KPI A" was met while "KPI B" did not, my hunch is that they both have different thresholds set and should you have defined entities for both KPIs, did you split the aggregation of data by entities?

0 Karma


Hello @lloydknight ,
Both KPIS have as entities the different servers and the thresholds are the same:
Base severity: critical
Critical: 0

In a test way with the simulator it works as expected but not when conditions are met with real data.

Best regards,


0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...