Splunk IT Service Intelligence

KPI Shows 0 Entities but generated search from same kpi shows results

david_rose
Communicator

We have defined a service with an adhoc base search.

When i run the generated search from the kpi, i get results:
alt text

If I go to threshold settings, I see data in the trending (chose a random time, all time shows data)
alt text

But if I go to service analyzer, and click on the service, the KPI shows N/A and it shows 0 Entities. Am i missing something?

0 Karma

esnyder_splunk
Splunk Employee
Splunk Employee

This might be related to the number of services/KPIs/saved searches you have. See best practice #3 here: https://www.splunk.com/en_us/blog/it/top-3-best-practices-for-configuring-splunk-itsi-in-a-large-sca...

But it depends on a lot of environmental factors. When did you run the two searches? The assumption is back-to-back. But if they're separated by, say, an hour and your service analyzer only looks at the past hour, then maybe you should be getting different results.

0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...