Splunk Enterprise

Splunk ITSI: how to pass KPI threshold field value to correlation search for alert

praveenbatchu
Engager

Greetings!

I developed Service, KPI in Splunk ITSI and configured correlation search to get alert with alert_value ($result.alert_value$) when KPI health score change to Critical. 

praveenbatchu_1-1602045299785.png

I am receiving alert correctly but alert_value always shows 0.0 (which is health score value, not the threshold field value) but I am expecting it to be the threshold field value. Is it possible to pass this threshold field value to correlation search or help guide me from where I can get this info from itsi summary index or ... ?

Here is the threshold field value (ex.,) when I run the search from Splunk ITSI (Generated Search in KPI)

praveenbatchu_0-1602045031579.png

Thank you. 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...