Splunk ITSI

MultiKPI Alerting in ITSI

pratik
Engager

Hi everyone,

I am trying to create a multi KPI alert. I have tens of services with 4-5 KPIs each. Using the multi KPI alert I want to create a correlation search which can send me an email alert if any of the KPIs are in critical severity for more than15 minutes. 

After selecting Status over time in the MultiKPI creation window, we have to set trigger for each of the KPIs. 

Is there a way to set the same trigger for all the KPIs? For example if any KPI is at Critical severity level >=50% of the last 30 minutes.

Seems like I am missing something, no way I have to click and set trigger for each KPI hundreds of times.

Thanks!

Labels (2)
0 Karma

skramp
SplunkTrust
SplunkTrust

I wouldn’t do it with the multi KPi alert. If you install the content pack for monitoring and alerting in ITSI there will be some new correlation searches which are monitoring a sustained status for Entities or KPIs or services. This searches can be modified if needed.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to February Tech Talks, Office Hours, and Webinars!

💌 Keep the new year’s momentum going with our February lineup of Community Office Hours, Tech Talks, ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Incident Response: Reduce Incident Recurrence with Automated Ticket Creation

Culture extends beyond work experience and coffee roast preferences on software engineering teams. Team ...