Splunk ITSI

Why ITSI Content Pack only show limited KPI in each Service ?

rendi7936
New Member

I was trying to test IT Shared content pack, downloaded, restored,
We see glass table deployed, services deployed, but when we look at one of service, such as NTP.

There is no preconfigured base search(es) KPI, only one: Heartbeat,

is this expected? do we miss something ?

If we deploy content pack Monitoring Unix and Linux,
we see preconfigured base search with many KPIs, and we see it looks like it has correct base search,

alt text

alt text

Labels (2)
0 Karma

esnyder_splunk
Splunk Employee
Splunk Employee

Hi Rendi, yes this is intended. The content is supposed to be a starting point for IT infrastructure monitoring, not necessarily the entire solution. It's intended to give users an idea of how to set up their environment, how to structure dependencies, etc. 

The hope is that customers will install it, and then do their own configuration of services and alerts. If you look at the post-install documentation for the content pack you'll see this elaborated on a bit more. 

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...