Splunk IT Service Intelligence
Highlighted

How do I read stored ITSI metrics into a custom dashboard outside of ITSI?

Communicator

We're implementing ITSI and we want to import ITSI metrics into a custom dashboard, without having to manually duplicate all of the searches. For instance, we define a service and KPIs in ITSI, then in a separate app/dashboard, we want to read the stored KPI values to present in a dashboard.

The questions are: Where are the ITSI data stored -- is it all in index=itsi_summary? And what is the best way to access the data by KPI and Service name?

I saw a talk at .conf2016 using the query below to access the overall service health score to put in a custom dashboard (for example with a Siteminder service):

index=itsi_summary source=service_health_monitor 
| eval service_name="Siteminder" 
| lookup alarm_console_lookup title as service_name OUTPUT kpis._key as service_id_mv 
| eval service_id = mvindex(service_id_mv, mvfind(service_id_mv, "SHKPI"))

Is this the best approach to do this? Because I seem to get duplicate time values. And what would be the best way to extract the individual KPIs? I think they are in different "source" in the itsi_summary index, but i'll need to map out how to access them by the KPI and service name since they all apparently use hash ids for keys.

I'm hoping someone has done this and it's straight forward without having to spend too much digging through the itsi_summary index.

Thanks

Highlighted

Re: How do I read stored ITSI metrics into a custom dashboard outside of ITSI?

Communicator

In case anyone is interested in how to do this, I figure out a solution.

First, I set up a saved search that spits out a kvstore lookup to augment the alarmconsolelookup with the Service and KPI names:

| inputlookup alarm_console_lookup 
    | rename kpis._key as kpis_key, kpis.title as kpis_title, title as Service 
    | eval zipped = mvzip(kpis_key, kpis_title) 
    | mvexpand zipped 
    | fields zipped Service 
    | eval temp=split(zipped,",") 
    | eval key=mvindex(temp,0) 
    | eval KPI=mvindex(temp,1) 
    | fields - temp - zipped 
    | eval source = if(substr(key,1,5)=="SHKPI", "service_health_monitor", "Indicator - ".key." - ITSI Search")
    | table key, KPI, Service, source
    | outputlookup itsi_keys

Then I can use this to quickly pull the metrics I want from itsi_summary:

index=itsi_summary earliest=-241m@m latest=-1m@m 
| lookup itsi_keys key as itsi_kpi_id 
| search Service="Siteminder" 
    AND (KPI=ServiceHealthScore 
    OR (KPI="Authentication Rejections" AND indexed_is_service_max_severity_event=1) 
    OR (KPI="Available Memory (MB)" AND indexed_is_service_max_severity_event=1) )

Seems to work pretty well so far.

View solution in original post

0 Karma
Highlighted

Re: How do I read stored ITSI metrics into a custom dashboard outside of ITSI?

Explorer

When I run the first query I get an error "Error in 'outputlookup' command: The lookup table 'itsi_keys' is invalid.". What am i doing wrong 😞

0 Karma
Highlighted

Re: How do I read stored ITSI metrics into a custom dashboard outside of ITSI?

Communicator

The outputlookup command it trying to write to a kvstore lookup table that I first defined. In my app, I edited both the collections.conf and transforms.conf in my default folder as follows:

collections.conf:
[itsi_link]

transforms.conf:
[itsikeys]
external
type=kvstore
collection=itsilink
fields
list = key, KPI, Service, service_kpi, weight, source

After you define those, the output should work.

Note however: I was just on a call with professional services regarding this topic - and they mentioned that there is a servicekpilookup that does something very similar to the itsi_keys lookup I defined above. So you may be able to use that directly in your search.

0 Karma