Splunk ITSI

How can I get the failure count value in Glass table?

Mayanakhan
Explorer

I have created one base search and multiple services with entities and also created KPI using the base search.
I try to drag the KPI to glass table to get a count of particular service. In search, I get the alert value as 6 but in glass table, it shows as 0 or 10(sum of errors of all servers).

The same search is working if add a ad-hoc search in service.

Base search

index=os sourcetype=port_availability  | dedup HostName |search Status!="Connection successful"| table _time HostName port Status| eval Priority="P3"

PFA screenshots for your reference,
alt text
alt text 2: /storage/temp/228771-base-search.jpg
alt text

0 Karma

skoelpin
SplunkTrust
SplunkTrust

You should open your KPI search and expand the macro out cmd + shift + e . Then strip everything off below the first stats command and see what it's using to create the search. You are most likely not summing the value

0 Karma

Mayanakhan
Explorer

In KPI search it showing the correct value. But not in glass table.

Also there is no option for count in Service/Aggregate calculation.
alt text

https://ibb.co/ekCpAn

0 Karma
Get Updates on the Splunk Community!

Blueprints for High-Maturity Operations: Splunk Lantern Articles on SOAR, ES 8.4, ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

Simplifying the Analyst Experience with Finding-based Detections

    Splunk invites you to an engaging Tech Talk focused on streamlining security operations with ...

[Puzzles] Solve, Learn, Repeat: Word Search

This challenge was first posted on Slack #puzzles channelThis puzzle is based on a letter grid containing ...