Splunk ITSI

Why are my KPIs not taking the defined entities?

AnushaJone
New Member

Hi,

 

I have been building OS monitoring KPIs for our agency.  As part of this process we defined entities as below

 

itsi entity mgmt - index=indexname host=*controlm* | dedup host  | eval entity_type=coalesce(entity_type, "controlm") | table host entity_type

 

it's listing the hosts that are associated to controlm agency.  I am taking entity rule like below

Alias is host and matches *controlm* but why my KPIs are not automatically running against these hosts defined in entities?

Labels (1)
0 Karma

skramp
SplunkTrust
SplunkTrust

You have imported your entities (I assume you check them in the entity management) and you have added them to your service. But you have also configured in your KPIs to split by host and take only entities which are for this service?

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...