Splunk ITSI

MultiKPI Alerting in ITSI

pratik
Engager

Hi everyone,

I am trying to create a multi KPI alert. I have tens of services with 4-5 KPIs each. Using the multi KPI alert I want to create a correlation search which can send me an email alert if any of the KPIs are in critical severity for more than15 minutes. 

After selecting Status over time in the MultiKPI creation window, we have to set trigger for each of the KPIs. 

Is there a way to set the same trigger for all the KPIs? For example if any KPI is at Critical severity level >=50% of the last 30 minutes.

Seems like I am missing something, no way I have to click and set trigger for each KPI hundreds of times.

Thanks!

Labels (2)
0 Karma

skramp
SplunkTrust
SplunkTrust

I wouldn’t do it with the multi KPi alert. If you install the content pack for monitoring and alerting in ITSI there will be some new correlation searches which are monitoring a sustained status for Entities or KPIs or services. This searches can be modified if needed.

Get Updates on the Splunk Community!

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

AI Adoption Hub Launch | Curated Resources to Get Started with AI in Splunk

Hey Splunk Practitioners and AI Enthusiasts! It’s no secret (or surprise) that AI is at the forefront of ...