Splunk ITSI

Can I use Rest API command into ITSI?

htramtran83
Explorer

I want to find the concurrent search limit (max_rt_searches/max_hist_scheduled_searches...)

| rest "/services/server/status/limits/search-concurrency?cluster_wide_quota=1"

| stats max(max_hist_searches) as max_hist_searches, max(max_hist_scheduled_searches) as max_hist_scheduled_searches, max(max_rt_searches), as max_rt_searches, max(max_rt_scheduled_searches) as max_rt_scheduled_searches, max(max_auto_summary_searches) as max_auto_summary_searches

| fields max_hist_searches, max_hist_scheduled_searches,

max_rt_searches, max_rt_scheduled_searches,
max_auto_summary_searches,

I cannot create KPI inside ITSI. Anyone can help me explain?

0 Karma

yannK
Splunk Employee
Splunk Employee

ITSI KPI searches need to preserve necessary fields to work,

As mentioned here: https://docs.splunk.com/Documentation/ITSI/latest/Configure/AddKPIs#Define_a_source_search_from_an_a...

The ad hoc search string that you create. This is the event gathering search for the KPI.
Note: The use of transforming commands, the mstats command, the gettime macro, or time modifiers in your KPI search is not recommended as this may cause issues with KPI backfill, the display of raw data on ITSI views such as glass tables and deep dives that allow you to run KPI searches against raw data, and the KPI threshold preview.

in your case, you need to preserve the field _time. (maybe others, depending of your filters/entities lookup mapping etc...)

try to add something like that to your stats command

| stats first(_time) AS _time
and to your fields
| fields _time ...

0 Karma

atsviatkou_splu
Splunk Employee
Splunk Employee

Do you want to track value of max_rt_searches/max_hist_scheduled_searches as a KPI?

In a ITSI service create/edit UI you can do KPI > New > Generic KPI
give a name, click next add Ad hoc Search such as

| rest "/services/server/status/limits/search-concurrency?cluster_wide_quota=1"
| stats max(max_hist_searches) as max_hist_searches, 
        max(max_hist_scheduled_searches) as max_hist_scheduled_searches,
        max(max_rt_searches), as max_rt_searches,
        max(max_rt_scheduled_searches) as max_rt_scheduled_searches,
        max(max_auto_summary_searches) as max_auto_summary_searches
| eval rt_search_multiplier=max_rt_searches/max_hist_scheduled_searches
| fields rt_search_multiplier

Use rt_search_multiplier as Threshold Field

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...