Splunk IT Service Intelligence

Splunk ITSI : How to configure CPU and Memory Utilization and disk usage KPI's?

Dinesh_Raja
Path Finder

I m new to ITSI, I would like to configure CPU & Memory Utilization, Disk usage KPI's on ITSI. Kindly let me know the steps from scratch/document which will help to achieve the same.

Thanks.

0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

You should try to use the least amount of searches as possible to get the values, you can use base searches to achieve this. If you're new to ITSI then perhaps you should experiment with adhoc searches first sense they are easier and will give faster time to value. First you create a new service Configure > Services then you need to create the 3 KPI's to that service. You need the searches for this. Then you can set thresholds.

View solution in original post

skoelpin
SplunkTrust
SplunkTrust

You should try to use the least amount of searches as possible to get the values, you can use base searches to achieve this. If you're new to ITSI then perhaps you should experiment with adhoc searches first sense they are easier and will give faster time to value. First you create a new service Configure > Services then you need to create the 3 KPI's to that service. You need the searches for this. Then you can set thresholds.

Dinesh_Raja
Path Finder

Thank you @skoelpin , it really helps.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Glad to help. Did this answer your question? If so can you accept it to close it out? If not then feel free to ask additional questions and Id be happy to help

0 Karma

sapanda
Path Finder

hello @skoelpin ,

I also have the same situation.

I have configured a new service( Name : Test Service) and associated a Windows and a Linux CI as entities to the same. Then I created 2 KPIs( CPU for Windows and Memory for Linux) using Ad hoc searches. But after then when i check the Service Analyzer , I am expecting to see my service in the same, but I am not able to see it. Any suggestions?

Thanks,
Sapan

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Open a new question and I will answer it

0 Karma
Get Updates on the Splunk Community!

Enter the Dashboard Challenge and Watch the .conf24 Global Broadcast!

The Splunk Community Dashboard Challenge is still happening, and it's not too late to enter for the week of ...

Join Us at the Builder Bar at .conf24 – Empowering Innovation and Collaboration

What is the Builder Bar? The Builder Bar is more than just a place; it's a hub of creativity, collaboration, ...

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...