All Apps and Add-ons

ITSI: two KPIS with critical severity not working


Hello all,

I am trying to configure a service in ITSI with two KPIS ("A", "B") with the most severity (11).

When I do the test inside the configuration of the service it works perfectly, if any of these KPIS get critical status, global health score of the service gets 0 (critical).

But in the practice, when the service is running with real data, only when "A" gets critical, global health score of the service changes to critical, but it does not happens with "B". I seems that system gives more importance to "A" than "B".

I would like to ask if someone is facing the same issue, if someone knows that this is a real limitation of ITSI (although in testing mode when setting configuration of service it works well) and if someone has a solution for this.

Thanks very much in advance for the help,

0 Karma


Hello @jaimelopez

Aside from both A and B's KPI Importance value set to 11, may I know if you've set entities on them and what are the thresholds of A and B KPI?

While the condition on "KPI A" was met while "KPI B" did not, my hunch is that they both have different thresholds set and should you have defined entities for both KPIs, did you split the aggregation of data by entities?

0 Karma


Hello @lloydknight ,
Both KPIS have as entities the different servers and the thresholds are the same:
Base severity: critical
Critical: 0

In a test way with the simulator it works as expected but not when conditions are met with real data.

Best regards,


0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...