in ITSI
The search analyzer get populated by the summarized KPI data. (from index=itsi_summary in older versions, from metric index=itsi_summary_metrics since ITSI 4.7)
To get data in it this requires those steps :
- define some entities (optional, but nicer), if you have normalized data from official addons, you could look to enable the default entity detections (they can pick up linux metrics, windows entities, databases etc)
- create services (with filters to find entities if you are using entities), and some KPIs. If you are using normalized data, you can look at the "shared base searches" examples shipped to create your KPIs.
- the KPI are working like scheduled saved searches, they will start to summarize your metrics, and save the result into the indexes
- then the service analyzer will have data to measure the services healthscores, and will start populate.
for details on the service insight : https://docs.splunk.com/Documentation/ITSI/4.9.2/SI/AboutSI
The other feature in ITSI is to use Alerting / Episodes
To get it setup
- create correlation searches, generating notable events (going to the index=itsi_tracked_alerts)
- OR if you have KPIs, use multiKPI alerting
- the Rules engine will detect them in realtime (you need realtime allowed), and group them in to episodes in to index=itsi_grouped_alerts
- the episodes will be displayed in the "incident review" dashboard
for details on "Event Analytics" https://docs.splunk.com/Documentation/ITSI/4.9.2/EA/AboutEA
for ITSI to work, please double check that :
- you have realtime allowed
- that JAVA is installed on the SH
- that the SA-IndexCreation app was properly deployed on the indexers
- that your ITSI SH is able to forward data to the indexers
- that HEC is enabled and working on the SH
