Splunk ITSI

Why are my KPIs not taking the defined entities?

AnushaJone
New Member

Hi,

 

I have been building OS monitoring KPIs for our agency.  As part of this process we defined entities as below

 

itsi entity mgmt - index=indexname host=*controlm* | dedup host  | eval entity_type=coalesce(entity_type, "controlm") | table host entity_type

 

it's listing the hosts that are associated to controlm agency.  I am taking entity rule like below

Alias is host and matches *controlm* but why my KPIs are not automatically running against these hosts defined in entities?

Labels (1)
0 Karma

skramp
SplunkTrust
SplunkTrust

You have imported your entities (I assume you check them in the entity management) and you have added them to your service. But you have also configured in your KPIs to split by host and take only entities which are for this service?

0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

  Ready to master Kubernetes and cloud monitoring like the pros?Join Splunk’s Growth Engineering team for an ...

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...