How do I handle customized time ranges in Splunk IT Service Intelligence (ITSI)?

[EricLloyd79]

So it seems ITSI provides 4 calculation windows:
Last Minute
Last 5 Minutes
Last 15 Minutes
Last 24 Hours

Has anyone found a way to circumvent this surprising limitation? The majority of my KPIs are measured from the start of the current day until the present moment.

(Is ITSI 4.0 going to address this?)

[skoelpin · Accepted solution]

Are you referring to the KPI frequency or the timespan that is checked? If the latter, you can simply use time modifiers inline of the search like this

index=... sourcetype=.... earliest=@d latest=now

[EricLloyd79]

Odd. I've tried this and it didn't work. Let me try again. Im doing it creating a KPI Base Search.

[EricLloyd79]

Yes it seemed to work this time. Thanks.

[skoelpin]

It will definitely work, I use it on several KPI base searches with success