Splunk IT Service Intelligence

ITSI and weekly/monthly KPI

jwillaime
Explorer

Hello,

I'm currently using ITSI to monitor some services from which the KPI are calculated over small time window (15 minutes by default). I see that the calculation window of the KPI base search creation tool do not have any option than 24 hours.

I would like to know if it is possible to have a KPI calculated over a bigger time window (eg, a week or a month). I have the feeling that that is not the purpose of ITSI, but I'm curious.

Thank you.

0 Karma

yannK
Splunk Employee
Splunk Employee

As KPI are summary searches, there are no use cases for reporting on pooling of more than 24h.

if you want to report on data from a larger timerange, you could precalculate it using another scheduled search, and summarize the results (or use a lookup), then carve a custom KPI to retrieve it, and add fake _time fields.

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...