Splunk ITSI

Unable to find kpi_value in itsi_summary index

krutika_ag
Path Finder

Hello,

 

I want to create a dataset for Machine Learning,

I want kpi name and Service Health Score as field name and their value as value for last 14 days,

how do i retrieve kpi_value and health_score value, is it stored somewhere in itsi index?

I cannot find kpi_value field in index=itsi_summary

#predictive analaytics #machine learning, splunk it


#predictive analytic 
Splunk Machine Learning Toolkit 
#Splunk ITSI

Also, if you have done Machine Learning / Predictive ANalytics in your environment, please suggest a approach 

Labels (1)
Tags (1)
0 Karma

proyleJDS
Path Finder

Are you looking for something like this?

 

index=itsi_summary 
| eval kpiid = mvappend(kpiid, itsi_kpi_id) 
| stats latest(alert_value) as alert_value latest(alert_severity) as health_score by kpiid kpi 
| join type=left kpiid 
    [| inputlookup service_kpi_lookup 
| stats latest(title) as title by kpis._key 
    | rename kpis._key as kpiid
        ] 
| search title IN ("<Service Names>") kpi!="ServiceHealthScore"

 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...