Splunk IT Service Intelligence

What is difference between N/A and 0 value on kpi result?

vinayakwagh
Engager

Some KPI in service shows N/A value on default service analyzer but as soon as I change time range on default service analyzer from 12 hours to 24 hours the KPI which showing N/A as result convert to 0 and stated as normal don't know why this is happening and also can we convert N/A result value of KPI to 0 in default service analyzer.

0 Karma
1 Solution

esnyder_splunk
Splunk Employee
Splunk Employee

This is most likely due to gaps in the data - so if interval is 5 mins per KPI, but data only comes every 15 mins, then you will get gaps and N/A values. If you have selected to fill data gaps with "Null Values" in the service definition, this is probably what's going on: https://docs.splunk.com/Documentation/ITSI/latest/Configure/AddKPIs#Step_4:_Add_monitoring_calculati...

Check the ITSI Health Check dashboard "KPI Performance" panel for skipped searches. It usually happens because you're either overloading your search head with work or the search that you wrote takes so long that it is not done before the next search is scheduled to start, so it skips the next run (if it did not, you would enter an endless growth of searches that cannot finish).

View solution in original post

esnyder_splunk
Splunk Employee
Splunk Employee

This is most likely due to gaps in the data - so if interval is 5 mins per KPI, but data only comes every 15 mins, then you will get gaps and N/A values. If you have selected to fill data gaps with "Null Values" in the service definition, this is probably what's going on: https://docs.splunk.com/Documentation/ITSI/latest/Configure/AddKPIs#Step_4:_Add_monitoring_calculati...

Check the ITSI Health Check dashboard "KPI Performance" panel for skipped searches. It usually happens because you're either overloading your search head with work or the search that you wrote takes so long that it is not done before the next search is scheduled to start, so it skips the next run (if it did not, you would enter an endless growth of searches that cannot finish).

Get Updates on the Splunk Community!

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...