Splunk ITSI

Why is ITSI ServiceHeathScore showing incorrect health score?

AKG11
Path Finder

Hello,

We have recently started using ITSI and noticed that some false service health degradation alerts are getting generated.  when we checked the deep dive in some cases all the KPI under service are green but still overall health shown yellow and some times red.

Trying to understand the behavior.

AKG11_0-1686245009209.png

Thanks
Ankit

Labels (2)
Tags (3)
0 Karma

srauhala_splunk
Splunk Employee
Splunk Employee

Hi! 

The deep dives does a roll up of the data depending on the time span selected. To review the KPI health in details look at the itsi summary index.  

index=itsi_summary [|`service_kpi_list` | search service_name="my_service_name" kpi_name=my_kpi | fields kpiid | format ]
| lookup service_kpi_lookup _key as itsi_service_id OUTPUT title as service_name
| table _time kpi, alert_*, entity_* service*,indexed_is_service_aggregate

 

0 Karma
Get Updates on the Splunk Community!

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Customers Increasingly Choose Splunk for Observability

For the second year in a row, Splunk was recognized as a Leader in the 2024 Gartner® Magic Quadrant™ for ...