How to set KPI Search Schedule less than 1 minute?

[nerdyboy99]

I know the KPI Search Schedule can only select items as mentioned in the picture.

But in case I want the information to be displayed faster by set the Search Schedule KPI to less than 1 minute, is there a way to do this?

Or if not, what is the best way to display information on Glass Table in the fastest way?

Because the information on the Glass Table has to wait for the KPI Search Schedule to complete their task while the raw data has been uploaded to Splunk before. This causes the Glass Table information to appear slower than the actual data (about 3 minutes according to my observations).

Thank you very much if anyone can help.

[srauhala_splunk]

You could consider searching the raw data in the glass table instead of using the itsi kpi summary. 

Remember that the KPI will have a time unit. For example number of logins per minute the past one minute. If you change this KPI to be calculate every X seconds either change the KPI to calculate the number of logins for the past  X seconds as well. 

Also note that there will always be some ingestion delay, i.e. time from when an event/metrics was created to when splunk will be able to retrieve it from an index. Configuring ITSI to search to close to the current time can case KPIs to show up as "NA" since no data for that time was available at the time the search was executed. 

/Seb 

[nerdyboy99]

I understand your suggestion of using search to extract data from the index without configuring it through KPIs, and I have given it some thought.

However, I would also like to display the health color of the Service on GT, which can only be calculated by ITSI and requires the KPIs to be configured there.

So it seems that accepting the delay on GT may be the only way to achieve this.

[richgalloway]

I am NOT suggesting replacing KPIs with searches.

Every KPI is powered by a search.  It's possible that those searches could be made more efficient (faster), therefore making the GT load faster.

[richgalloway]

The search schedule cannot be less than 1 minute.

If it takes 3 minutes to render the Glass Table then perhaps the searches in the GT could be made more efficient.