Splunk IT Service Intelligence

What is difference between N/A and 0 value on kpi result?

vinayakwagh
Engager

Some KPI in service shows N/A value on default service analyzer but as soon as I change time range on default service analyzer from 12 hours to 24 hours the KPI which showing N/A as result convert to 0 and stated as normal don't know why this is happening and also can we convert N/A result value of KPI to 0 in default service analyzer.

0 Karma
1 Solution

esnyder_splunk
Splunk Employee
Splunk Employee

This is most likely due to gaps in the data - so if interval is 5 mins per KPI, but data only comes every 15 mins, then you will get gaps and N/A values. If you have selected to fill data gaps with "Null Values" in the service definition, this is probably what's going on: https://docs.splunk.com/Documentation/ITSI/latest/Configure/AddKPIs#Step_4:_Add_monitoring_calculati...

Check the ITSI Health Check dashboard "KPI Performance" panel for skipped searches. It usually happens because you're either overloading your search head with work or the search that you wrote takes so long that it is not done before the next search is scheduled to start, so it skips the next run (if it did not, you would enter an endless growth of searches that cannot finish).

View solution in original post

esnyder_splunk
Splunk Employee
Splunk Employee

This is most likely due to gaps in the data - so if interval is 5 mins per KPI, but data only comes every 15 mins, then you will get gaps and N/A values. If you have selected to fill data gaps with "Null Values" in the service definition, this is probably what's going on: https://docs.splunk.com/Documentation/ITSI/latest/Configure/AddKPIs#Step_4:_Add_monitoring_calculati...

Check the ITSI Health Check dashboard "KPI Performance" panel for skipped searches. It usually happens because you're either overloading your search head with work or the search that you wrote takes so long that it is not done before the next search is scheduled to start, so it skips the next run (if it did not, you would enter an endless growth of searches that cannot finish).

Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...