Why is my Splunk IT Service Intelligence (ITSI) service health score not being reflected correctly?

[EricLloyd79]

If I understand correctly, a Service Health Score is an aggregation of all the KPI health scores in that service.

As you can see in the screenshot, something is off with my Service Health Score. It seems to be down despite all the other KPI health scores being in the green range.

Has anyone else experienced this before?

Note, I did create a new KPI around this time. Does that cause a dip in Service Health Score?
Thanks.

[skoelpin · Accepted solution]

Do you have any dependent services which would affect the ServiceHealthScore? What's your timerange set to? Have you tried changing from average to max?

[EricLloyd79]

I do not have any dependent services.
My time range is set to 12 hours.
I have tried changing from average to max and I do see some variation in the other KPIs now that would possibly affect the health score.
I guess I misunderstand the concept behind the change between Average and Max. Arent the values displayed in the Sparklines of the KPIs the actual values specified in the metrics when the service is created? What is Max, the max of for a particular point in time for a kpi if we already specified what value we are seeking when we create the KPI?
Thanks for clarity.

[skoelpin]

Try reducing the timerange to one hour. Sometimes the affected KPI's will show themselves which is driving down the ServiceHealthScore value.

As for Average, Min, and Max.. The timerange has multiple values and as you expand out the timerange, your expanding out to multiple values

[EricLloyd79]

Thanks skoelpin. You can to the rescue again.