Splunk IT Service Intelligence

Splunk IT Service Intelligence: In deep dives, what is the difference between "Open in search" and "Edit KPI"?

venkatesh296
Explorer

Hello Splunkers,

In ITSI I created a KPI calculation window for last 24hrs, but when I go to that KPI in deep dives on the left hand side, we can see a gear icon. When I click on that, we have an option like "open in search" and "edit KPI". When I open both in a new tab, "open in search" shows for last 1hr events, "edit KPI" shows for last 24hrs what I defined in KPI. I just want to know what is the difference between them?

Thanks.

0 Karma

thejeffreystone
Path Finder

Context I believe. When you open in search it is defaulting to the 1 hour as set in your settings for your default time picker. In the KPI in ITSI you defined the search time as 24 hours.

0 Karma

venkatesh296
Explorer

Thanks for your reply.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!