Splunk ITSI

Splunk ITSI Episodes count for a Service inside the glasstable

inventsekar
SplunkTrust
SplunkTrust

Hi All.., 

Pretty new to ITSI and i have created a GlassTable with KPI Services - CPU, Memory and Disk Utilization. 

new-itsi-disk-cpu.jpg

now i would like to add the number of episodes for the service CPU, but i am not sure how to get the number of episodes for a given service. any ideas, suggestions please. 

 

This below image shows the number of episodes occurred for memory_usage. Here we have grouped the events... so i need this count to be appeared on the glass table. 

new-itsi-episodes.jpg

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
Labels (2)
0 Karma

eduncan
Splunk Employee
Splunk Employee

You just need to create a KPI inside of each service that counts NEAPS.  Something like this for your KPI search:  

index=itsi_grouped_alerts service_name="Put your service name here"

 

For your split by field you want to use the itsi_group_id

 

For your calculation use distinct count or count.  Then you just drag that KPI to your glass table.

 

inventsekar
SplunkTrust
SplunkTrust

Sure, will try this and update you back. Thanks.

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

Bridging the Gap: Splunk Helps Students Move from Classroom to Career

The Splunk Community is a powerful network of users, educators, and organizations working together to tackle ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...