Splunk IT Service Intelligence

Can I use Rest API command into ITSI?

htramtran83
Explorer

I want to find the concurrent search limit (max_rt_searches/max_hist_scheduled_searches...)

| rest "/services/server/status/limits/search-concurrency?cluster_wide_quota=1"

| stats max(max_hist_searches) as max_hist_searches, max(max_hist_scheduled_searches) as max_hist_scheduled_searches, max(max_rt_searches), as max_rt_searches, max(max_rt_scheduled_searches) as max_rt_scheduled_searches, max(max_auto_summary_searches) as max_auto_summary_searches

| fields max_hist_searches, max_hist_scheduled_searches,

max_rt_searches, max_rt_scheduled_searches,
max_auto_summary_searches,

I cannot create KPI inside ITSI. Anyone can help me explain?

0 Karma

yannK
Splunk Employee
Splunk Employee

ITSI KPI searches need to preserve necessary fields to work,

As mentioned here: https://docs.splunk.com/Documentation/ITSI/latest/Configure/AddKPIs#Define_a_source_search_from_an_a...

The ad hoc search string that you create. This is the event gathering search for the KPI.
Note: The use of transforming commands, the mstats command, the gettime macro, or time modifiers in your KPI search is not recommended as this may cause issues with KPI backfill, the display of raw data on ITSI views such as glass tables and deep dives that allow you to run KPI searches against raw data, and the KPI threshold preview.

in your case, you need to preserve the field _time. (maybe others, depending of your filters/entities lookup mapping etc...)

try to add something like that to your stats command

| stats first(_time) AS _time
and to your fields
| fields _time ...

0 Karma

atsviatkou_splu
Splunk Employee
Splunk Employee

Do you want to track value of max_rt_searches/max_hist_scheduled_searches as a KPI?

In a ITSI service create/edit UI you can do KPI > New > Generic KPI
give a name, click next add Ad hoc Search such as

| rest "/services/server/status/limits/search-concurrency?cluster_wide_quota=1"
| stats max(max_hist_searches) as max_hist_searches, 
        max(max_hist_scheduled_searches) as max_hist_scheduled_searches,
        max(max_rt_searches), as max_rt_searches,
        max(max_rt_scheduled_searches) as max_rt_scheduled_searches,
        max(max_auto_summary_searches) as max_auto_summary_searches
| eval rt_search_multiplier=max_rt_searches/max_hist_scheduled_searches
| fields rt_search_multiplier

Use rt_search_multiplier as Threshold Field

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...