Can I add and use ad hoc search KPI without entities?

[deodion]

Can I add and use ad hoc search KPI without entities?

I have a service where I want to add a generic KPI and use ad hoc search, says like attached pic below,

I see that in Service Analyzer, the SSH Gateway KPI for SSH connection value is N/A, and it says 0 entities also.
I also tried to add host field at Split by Entity, Entity Filter Field, and Entity Alias Filtering, but no luck also,

Am I missing something? Thank you!

[sduff_splunk · Accepted solution]

It is not necessary to use entities with a KPI. You shouldn't need to worry about any of the Split by Entity, Entity Filter Field, and Entity Alias Filtering conditions.

I notice that your search uses stats, which is generally frowned upon when creating KPI searches. I believe that is what is causing your issue. Try the following search instead.

index=connectivity sourcetype=connect_ping | eval kpi_msg=if(action="connection succeeded", 100, 0)

Then use the latest kpi_msg as the aggregate value for the service.

[deodion]

yes you are correct I found the answer after I post question anyway thanks!