Splunk IT Service Intelligence

ITSI and weekly/monthly KPI

jwillaime
Explorer

Hello,

I'm currently using ITSI to monitor some services from which the KPI are calculated over small time window (15 minutes by default). I see that the calculation window of the KPI base search creation tool do not have any option than 24 hours.

I would like to know if it is possible to have a KPI calculated over a bigger time window (eg, a week or a month). I have the feeling that that is not the purpose of ITSI, but I'm curious.

Thank you.

0 Karma

yannK
Splunk Employee
Splunk Employee

As KPI are summary searches, there are no use cases for reporting on pooling of more than 24h.

if you want to report on data from a larger timerange, you could precalculate it using another scheduled search, and summarize the results (or use a lookup), then carve a custom KPI to retrieve it, and add fake _time fields.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...