Splunk ITSI

Splunk query to get the threshold values of different KPI's in ITSI.

Kumar23
Loves-to-Learn
 
Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust
What is your question?
---
If this reply helps you, Karma would be appreciated.
0 Karma

Kumar23
Loves-to-Learn

Hi @richgalloway did you understand my query? Please let me know for any further information.

 

Thanks,

Kumar23

0 Karma

richgalloway
SplunkTrust
SplunkTrust
No, I don't, but I replied only because your posting was empty.
eduncan has suggested a solution. I suggest you consider it.
---
If this reply helps you, Karma would be appreciated.
0 Karma

Kumar23
Loves-to-Learn

We will set the threshold values  for KPI's like High, Medium, Normal in ITSI right. I need  a query to get   that threshold values  for various KPI's.

0 Karma

eduncan
Splunk Employee
Splunk Employee

You can use this content pack:https://docs.splunk.com/Documentation/ITSICP/current/Config/AboutMA and it has corr searches that bring back KPI status.  You can use these as your starting point.  It will not tell you what the threshold is, rather if it is passed.  You don't need to pull the threshold setting you need to pull whether it has passed the threshold and then you can alert on it.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...