Splunk IT Service Intelligence

KPI Shows 0 Entities but generated search from same kpi shows results

david_rose
Communicator

We have defined a service with an adhoc base search.

When i run the generated search from the kpi, i get results:
alt text

If I go to threshold settings, I see data in the trending (chose a random time, all time shows data)
alt text

But if I go to service analyzer, and click on the service, the KPI shows N/A and it shows 0 Entities. Am i missing something?

0 Karma

esnyder_splunk
Splunk Employee
Splunk Employee

This might be related to the number of services/KPIs/saved searches you have. See best practice #3 here: https://www.splunk.com/en_us/blog/it/top-3-best-practices-for-configuring-splunk-itsi-in-a-large-sca...

But it depends on a lot of environmental factors. When did you run the two searches? The assumption is back-to-back. But if they're separated by, say, an hour and your service analyzer only looks at the past hour, then maybe you should be getting different results.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...