- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![nickmew nickmew](https://community.splunk.com/legacyfs/online/avatars/536947.jpg)
I may be missing something obvious, but I can't figure this out.
I have many applications set up as services set up in ITSI, all of which have an Application ID set up as their Service Title.
I have a stream of data coming in, which gives various counts, that I want to use as a KPI against these Services, which also has the Application ID stamped against them.
This data does not have any Entity information against it, so I can't filter by Entities linked to the Service.
I don't want to have to manually create a new search for each and every Application for these KPIs — they number in the hundreds and new ones come along regularly. I want to have a KPI base search and use this on a template service, so it is created only once.
Essentially need a KPI base search that filters by Service Title. Any ideas?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![Splunk Employee Splunk Employee](/html/@F88B7774A2BF2E9108D79A067A92A581/rank_icons/employee-16.png)
You can use the application IDs as entities. Import them into the ITSI master entity list (import via search is probably easiest), then for each of your application-based services, add a single filtered entity corresponding to the name of the service.
Examples for importing entities:
column appid (Import as Entity Title)
examples of these entities:
appid = web11
appid = fubar17
appid = backend42
Inside the service called "fubar17", specify an entity filter like this:
EntityTitle matches 'web11' (Alias 'appid' matches 'web11' will work, too)
Then, create a KPI base search which filters on entities, using field 'appid'.
For bonus points: you could set up a single app-based service with all the 'right' base-search KPIs, then use it to create a Service Template, then cookie-cutter create all of your other app-based services in a single 'bulk import' action. Very cool!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![Splunk Employee Splunk Employee](/html/@F88B7774A2BF2E9108D79A067A92A581/rank_icons/employee-16.png)
You can use the application IDs as entities. Import them into the ITSI master entity list (import via search is probably easiest), then for each of your application-based services, add a single filtered entity corresponding to the name of the service.
Examples for importing entities:
column appid (Import as Entity Title)
examples of these entities:
appid = web11
appid = fubar17
appid = backend42
Inside the service called "fubar17", specify an entity filter like this:
EntityTitle matches 'web11' (Alias 'appid' matches 'web11' will work, too)
Then, create a KPI base search which filters on entities, using field 'appid'.
For bonus points: you could set up a single app-based service with all the 'right' base-search KPIs, then use it to create a Service Template, then cookie-cutter create all of your other app-based services in a single 'bulk import' action. Very cool!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![nickmew nickmew](https://community.splunk.com/legacyfs/online/avatars/536947.jpg)
Thanks - I was wondering whether this might be the way to go, but wanted to see if there was something clever 'under the bonnet' I was missing
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![Splunk Employee Splunk Employee](/html/@F88B7774A2BF2E9108D79A067A92A581/rank_icons/employee-16.png)
This IS the cleverness under the bonnet 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![nickmew nickmew](https://community.splunk.com/legacyfs/online/avatars/536947.jpg)
not being able to filter by a primary key seems more like an obvious functional gap to me, but hey, that's the RDBMS background in me 🙂
![](/skins/images/FE4825B2128CA5F641629E007E333890/responsive_peak/images/icon_anonymous_message.png)