Splunk Enterprise

Splunk ITSI: how to pass KPI threshold field value to correlation search for alert

praveenbatchu
Engager

Greetings!

I developed Service, KPI in Splunk ITSI and configured correlation search to get alert with alert_value ($result.alert_value$) when KPI health score change to Critical. 

praveenbatchu_1-1602045299785.png

I am receiving alert correctly but alert_value always shows 0.0 (which is health score value, not the threshold field value) but I am expecting it to be the threshold field value. Is it possible to pass this threshold field value to correlation search or help guide me from where I can get this info from itsi summary index or ... ?

Here is the threshold field value (ex.,) when I run the search from Splunk ITSI (Generated Search in KPI)

praveenbatchu_0-1602045031579.png

Thank you. 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...