Splunk IT Service Intelligence

ITSI and weekly/monthly KPI

jwillaime
Explorer

Hello,

I'm currently using ITSI to monitor some services from which the KPI are calculated over small time window (15 minutes by default). I see that the calculation window of the KPI base search creation tool do not have any option than 24 hours.

I would like to know if it is possible to have a KPI calculated over a bigger time window (eg, a week or a month). I have the feeling that that is not the purpose of ITSI, but I'm curious.

Thank you.

0 Karma

yannK
Splunk Employee
Splunk Employee

As KPI are summary searches, there are no use cases for reporting on pooling of more than 24h.

if you want to report on data from a larger timerange, you could precalculate it using another scheduled search, and summarize the results (or use a lookup), then carve a custom KPI to retrieve it, and add fake _time fields.

0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...