Splunk Enterprise

Splunk ITSI: how to pass KPI threshold field value to correlation search for alert

praveenbatchu
Engager

Greetings!

I developed Service, KPI in Splunk ITSI and configured correlation search to get alert with alert_value ($result.alert_value$) when KPI health score change to Critical. 

praveenbatchu_1-1602045299785.png

I am receiving alert correctly but alert_value always shows 0.0 (which is health score value, not the threshold field value) but I am expecting it to be the threshold field value. Is it possible to pass this threshold field value to correlation search or help guide me from where I can get this info from itsi summary index or ... ?

Here is the threshold field value (ex.,) when I run the search from Splunk ITSI (Generated Search in KPI)

praveenbatchu_0-1602045031579.png

Thank you. 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Dashboard Challenge and Watch the .conf24 Global Broadcast!

The Splunk Community Dashboard Challenge is still happening, and it's not too late to enter for the week of ...