Splunk Enterprise

Splunk ITSI: how to pass KPI threshold field value to correlation search for alert

praveenbatchu
Engager

Greetings!

I developed Service, KPI in Splunk ITSI and configured correlation search to get alert with alert_value ($result.alert_value$) when KPI health score change to Critical. 

praveenbatchu_1-1602045299785.png

I am receiving alert correctly but alert_value always shows 0.0 (which is health score value, not the threshold field value) but I am expecting it to be the threshold field value. Is it possible to pass this threshold field value to correlation search or help guide me from where I can get this info from itsi summary index or ... ?

Here is the threshold field value (ex.,) when I run the search from Splunk ITSI (Generated Search in KPI)

praveenbatchu_0-1602045031579.png

Thank you. 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Community Feedback

We Want to Hear from You! Share Your Feedback on the Splunk Community   The Splunk Community is built for you ...

Manual Instrumentation with Splunk Observability Cloud: Implementing the ...

In our observability journey so far, we've built comprehensive instrumentation for our Worms in Space ...