Splunk ITSI

Can I use Rest API command into ITSI?

htramtran83
Explorer

I want to find the concurrent search limit (max_rt_searches/max_hist_scheduled_searches...)

| rest "/services/server/status/limits/search-concurrency?cluster_wide_quota=1"

| stats max(max_hist_searches) as max_hist_searches, max(max_hist_scheduled_searches) as max_hist_scheduled_searches, max(max_rt_searches), as max_rt_searches, max(max_rt_scheduled_searches) as max_rt_scheduled_searches, max(max_auto_summary_searches) as max_auto_summary_searches

| fields max_hist_searches, max_hist_scheduled_searches,

max_rt_searches, max_rt_scheduled_searches,
max_auto_summary_searches,

I cannot create KPI inside ITSI. Anyone can help me explain?

0 Karma

yannK
Splunk Employee
Splunk Employee

ITSI KPI searches need to preserve necessary fields to work,

As mentioned here: https://docs.splunk.com/Documentation/ITSI/latest/Configure/AddKPIs#Define_a_source_search_from_an_a...

The ad hoc search string that you create. This is the event gathering search for the KPI.
Note: The use of transforming commands, the mstats command, the gettime macro, or time modifiers in your KPI search is not recommended as this may cause issues with KPI backfill, the display of raw data on ITSI views such as glass tables and deep dives that allow you to run KPI searches against raw data, and the KPI threshold preview.

in your case, you need to preserve the field _time. (maybe others, depending of your filters/entities lookup mapping etc...)

try to add something like that to your stats command

| stats first(_time) AS _time
and to your fields
| fields _time ...

0 Karma

atsviatkou_splu
Splunk Employee
Splunk Employee

Do you want to track value of max_rt_searches/max_hist_scheduled_searches as a KPI?

In a ITSI service create/edit UI you can do KPI > New > Generic KPI
give a name, click next add Ad hoc Search such as

| rest "/services/server/status/limits/search-concurrency?cluster_wide_quota=1"
| stats max(max_hist_searches) as max_hist_searches, 
        max(max_hist_scheduled_searches) as max_hist_scheduled_searches,
        max(max_rt_searches), as max_rt_searches,
        max(max_rt_scheduled_searches) as max_rt_scheduled_searches,
        max(max_auto_summary_searches) as max_auto_summary_searches
| eval rt_search_multiplier=max_rt_searches/max_hist_scheduled_searches
| fields rt_search_multiplier

Use rt_search_multiplier as Threshold Field

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...