Splunk IT Service Intelligence: In deep dives, what is the difference between "Open in search" and "Edit KPI"?

[venkatesh296]

Hello Splunkers,

In ITSI I created a KPI calculation window for last 24hrs, but when I go to that KPI in deep dives on the left hand side, we can see a gear icon. When I click on that, we have an option like "open in search" and "edit KPI". When I open both in a new tab, "open in search" shows for last 1hr events, "edit KPI" shows for last 24hrs what I defined in KPI. I just want to know what is the difference between them?

Thanks.

[thejeffreystone]

Context I believe. When you open in search it is defaulting to the 1 hour as set in your settings for your default time picker. In the KPI in ITSI you defined the search time as 24 hours.

[venkatesh296]

Thanks for your reply.