Why is ITSI ServiceHeathScore showing incorrect health score?

[AKG11]

Hello,

We have recently started using ITSI and noticed that some false service health degradation alerts are getting generated.  when we checked the deep dive in some cases all the KPI under service are green but still overall health shown yellow and some times red.

Trying to understand the behavior.

Thanks
Ankit

[srauhala_splunk]

Hi! 

The deep dives does a roll up of the data depending on the time span selected. To review the KPI health in details look at the itsi summary index.  

index=itsi_summary [|`service_kpi_list` | search service_name="my_service_name" kpi_name=my_kpi | fields kpiid | format ]
| lookup service_kpi_lookup _key as itsi_service_id OUTPUT title as service_name
| table _time kpi, alert_*, entity_* service*,indexed_is_service_aggregate