When using Splunk IT Service Intelligence (ITSI), how do I get a KPI Base search that filters by service title?

[nickmew]

I may be missing something obvious, but I can't figure this out.

I have many applications set up as services set up in ITSI, all of which have an Application ID set up as their Service Title.

I have a stream of data coming in, which gives various counts, that I want to use as a KPI against these Services, which also has the Application ID stamped against them.

This data does not have any Entity information against it, so I can't filter by Entities linked to the Service.

I don't want to have to manually create a new search for each and every Application for these KPIs — they number in the hundreds and new ones come along regularly. I want to have a KPI base search and use this on a template service, so it is created only once.

Essentially need a KPI base search that filters by Service Title. Any ideas?

[dmillis · Accepted solution]

You can use the application IDs as entities. Import them into the ITSI master entity list (import via search is probably easiest), then for each of your application-based services, add a single filtered entity corresponding to the name of the service.

Examples for importing entities:
column appid (Import as Entity Title)
examples of these entities:
appid = web11
appid = fubar17
appid = backend42

Inside the service called "fubar17", specify an entity filter like this:
EntityTitle matches 'web11' (Alias 'appid' matches 'web11' will work, too)

Then, create a KPI base search which filters on entities, using field 'appid'.

For bonus points: you could set up a single app-based service with all the 'right' base-search KPIs, then use it to create a Service Template, then cookie-cutter create all of your other app-based services in a single 'bulk import' action. Very cool!

[nickmew]

Thanks - I was wondering whether this might be the way to go, but wanted to see if there was something clever 'under the bonnet' I was missing

[dmillis]

This IS the cleverness under the bonnet 🙂

[nickmew]

not being able to filter by a primary key seems more like an obvious functional gap to me, but hey, that's the RDBMS background in me 🙂