Splunk IT Service Intelligence

ITSI and weekly/monthly KPI

jwillaime
Explorer

Hello,

I'm currently using ITSI to monitor some services from which the KPI are calculated over small time window (15 minutes by default). I see that the calculation window of the KPI base search creation tool do not have any option than 24 hours.

I would like to know if it is possible to have a KPI calculated over a bigger time window (eg, a week or a month). I have the feeling that that is not the purpose of ITSI, but I'm curious.

Thank you.

0 Karma

yannK
Splunk Employee
Splunk Employee

As KPI are summary searches, there are no use cases for reporting on pooling of more than 24h.

if you want to report on data from a larger timerange, you could precalculate it using another scheduled search, and summarize the results (or use a lookup), then carve a custom KPI to retrieve it, and add fake _time fields.

0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...