So it seems ITSI provides 4 calculation windows:
Last 5 Minutes
Last 15 Minutes
Last 24 Hours
Has anyone found a way to circumvent this surprising limitation? The majority of my KPIs are measured from the start of the current day until the present moment.
(Is ITSI 4.0 going to address this?)
Are you referring to the KPI frequency or the timespan that is checked? If the latter, you can simply use time modifiers inline of the search like this
index=... sourcetype=.... earliest=@d latest=now
Odd. I've tried this and it didn't work. Let me try again. Im doing it creating a KPI Base Search.
It will definitely work, I use it on several KPI base searches with success