I actually just got this one into place by simply adding a wildcard to props.conf, so it now looks like this: [default] TRANSFORMS = ingest-eval-rule-timeskew, ingest-eval-rule-evtsize, ingest-eval-rule-tierhost [(?::){0}*] TRANSFORMS = ingest-eval-rule-timeskew, ingest-eval-rule-evtsize, ingest-eval-rule-tierhost   And now all - except for a few internal sourcetypes, it's great. ... View more

How about _time | eval b=mvcount(_time) ... View more

Hi There,   Were you able to get this sorted? I have a similar issue where my CSVs are getting translated as a bunch of EXTRA_FIELD_## ... View more

The issue here is actually with the rendering engine of the sparkline or something about how core splunk (not ITSI) passes the values to the sparkline for rendering. If the time range is small enough (say last 60m) then that's small enough to bucket results passed to the sparkline into 1m spans which will result in 4 out of every 5 buckets not having a datapoint. (for a 5 minute KPI anyway) Interestingly enough, as per this answers post: https://community.splunk.com/t5/Archive/Sparkline-Format/td-p/61136 the sparkline rendering can be altered in SimpleXML and I've tested it with a dashboard. It would be a total ITSI hack, but it might well be possible to identify the conf file where the sparkline rendering config is passed for the service analyzer and modify to instead show a bar chart... the following results might look something more like this... ... View more

For ITSI v4.4 and above, you'll need to add report_as=text to the | rest portion of the SPL.   ITSI REST API reference  ... View more

@rmmiller thank you for your kind words ... View more

Thank you. I will give it a try! ... View more

Not sure what is doable. but if you are going the service-dependencies road, look at the way the service-health scores are calculated https://docs.splunk.com/Documentation/ITSI/4.4.0/Configure/HealthScores the weights can be a way to assign importance to your sub services But there is no way to do something like "2 of 3 are up" with the weights. For services dependencies, the upper service can only look at the last minute sub-services scores, (the current ones are not yet calculated), so there is a cascade effect, and a minute delay to see the updates. ... View more

When you configure a service template, there is an option that you can configure to consume entity rules from the CSV import during service creation. You should enable that during the service template creation/update. When you're importing services automatically, try to create the appropriate entity rule for that service. ... View more

@harsmarvania57 thanks, yes I always have matches, I control this while pushing to Splunk from scripted input. ... View more