Splunk IT Service Intelligence
Highlighted

How do I handle customized time ranges in Splunk IT Service Intelligence (ITSI)?

Builder

So it seems ITSI provides 4 calculation windows:
Last Minute
Last 5 Minutes
Last 15 Minutes
Last 24 Hours

Has anyone found a way to circumvent this surprising limitation? The majority of my KPIs are measured from the start of the current day until the present moment.

(Is ITSI 4.0 going to address this?)

0 Karma
Highlighted

Re: How do I handle customized time ranges in Splunk IT Service Intelligence (ITSI)?

SplunkTrust
SplunkTrust

Are you referring to the KPI frequency or the timespan that is checked? If the latter, you can simply use time modifiers inline of the search like this

index=... sourcetype=.... earliest=@d latest=now

View solution in original post

0 Karma
Highlighted

Re: How do I handle customized time ranges in Splunk IT Service Intelligence (ITSI)?

Builder

Odd. I've tried this and it didn't work. Let me try again. Im doing it creating a KPI Base Search.

0 Karma
Highlighted

Re: How do I handle customized time ranges in Splunk IT Service Intelligence (ITSI)?

SplunkTrust
SplunkTrust

It will definitely work, I use it on several KPI base searches with success

0 Karma
Highlighted

Re: How do I handle customized time ranges in Splunk IT Service Intelligence (ITSI)?

Builder

Yes it seemed to work this time. Thanks.