Splunk IT Service Intelligence

Why is the aggregated threshold for the KPIs only showing the values of the top entity?


We set up a service measuring datastore free space usage, overprovisioning , read and write activity.

Large amount of entities  are shown and per entity thresholds are working fine.

However the aggregated threshold for the KPIs show only the values of the top entity. 

According to manual the aggregated threshold should present an average of all entities result.

Is there a setting I am not using correct?

Labels (1)
0 Karma


It's possible that the aggregated threshold is set to only display the top entity due to a configuration setting.

You can check the settings and configuration documentation for the service to see if there is an option to display an average of all entities' results for the aggregated threshold. If not, you may need to modify the code or seek help from the vendor or support team for the service.

It's also possible that there is a bug in the service that's causing this behavior. In that case, you may want to report the issue to the vendor or support team for further investigation.

I hope it will help you. 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...