Splunk IT Service Intelligence

Why is my Splunk IT Service Intelligence (ITSI) service health score not being reflected correctly?

EricLloyd79
Builder

If I understand correctly, a Service Health Score is an aggregation of all the KPI health scores in that service.

As you can see in the screenshot, something is off with my Service Health Score. It seems to be down despite all the other KPI health scores being in the green range.

Has anyone else experienced this before?

Note, I did create a new KPI around this time. Does that cause a dip in Service Health Score?
Thanks.

alt text

1 Solution

skoelpin
SplunkTrust
SplunkTrust

Do you have any dependent services which would affect the ServiceHealthScore? What's your timerange set to? Have you tried changing from average to max?

View solution in original post

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Do you have any dependent services which would affect the ServiceHealthScore? What's your timerange set to? Have you tried changing from average to max?

0 Karma

EricLloyd79
Builder

I do not have any dependent services.
My time range is set to 12 hours.
I have tried changing from average to max and I do see some variation in the other KPIs now that would possibly affect the health score.
I guess I misunderstand the concept behind the change between Average and Max. Arent the values displayed in the Sparklines of the KPIs the actual values specified in the metrics when the service is created? What is Max, the max of for a particular point in time for a kpi if we already specified what value we are seeking when we create the KPI?
Thanks for clarity.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try reducing the timerange to one hour. Sometimes the affected KPI's will show themselves which is driving down the ServiceHealthScore value.

As for Average, Min, and Max.. The timerange has multiple values and as you expand out the timerange, your expanding out to multiple values

0 Karma

EricLloyd79
Builder

Thanks skoelpin. You can to the rescue again.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...