Are you looking for something like this?   index=itsi_summary | eval kpiid = mvappend(kpiid, itsi_kpi_id) | stats latest(alert_value) as alert_value latest(alert_severity) as health_score by kpiid kpi | join type=left kpiid [| inputlookup service_kpi_lookup | stats latest(title) as title by kpis._key | rename kpis._key as kpiid ] | search title IN ("<Service Names>") kpi!="ServiceHealthScore"   ... View more

You could use a search like this to check if the entities mapped in a service are receiving events within a specified time frame, if not you could consider them unstable and alert | inputlookup itsi_entities append=true | rename services._key as service_key | rename title as entity | fields entity, service_key | where isnotnull(service_key) | mvexpand service_key | inputlookup service_kpi_lookup append=true | eval key=coalesce(service_key,_key) | stats values(entity) as host, values(title) as service by key | mvexpand host | dedup host | fields host | eval host=lower(host) | join type=outer host [| metadata type=hosts index=_internal | eval host=lower(host) | eval status = if(lastTime>now()-180,1,0)] | eval status=if(status=1,1,0)   ... View more

What incident management software are you using? ... View more

You can use the rest API to find what you need | rest splunk_server=local /servicesNS/nobody/SA-ITOA/itoa_interface/entity report_as=text | eval value=spath(value,"{}") | mvexpand value | eval entity_id=spath(value, "_key"), entity_title=spath(value, "title"), entity_name=spath(value, "identifying_name"), retired=spath(value, "retired"), mod_time=spath(value, "mod_timestamp") | search retired=1 | eval epoch_time=strptime(mod_time,"%Y-%m-%dT%H:%M:%S.%6Q") | eval mod_time=mod_time." UTC" | eval date_retired=strptime(mod_time,"%Y-%m-%dT%H:%M:%S.%6Q+00:00 %Z") | convert ctime(date_retired) | fields entity_id entity_name date_retired ... View more

This search should give you a start on what you need | rest splunk_server=local /servicesNS/nobody/SA-ITOA/itoa_interface/service report_as=text filter="{\"enabled\":1}" | eval services_as_json=spath(value,"{}") | fields services_as_json | mvexpand services_as_json | eval kpis_as_json=spath(services_as_json, "kpis{}") | fields - services_as_json | mvexpand kpis_as_json | spath input=kpis_as_json | fields - kpis_as_json | rename key as kpiid | search service_title!="ServiceHealthScore" | eval search = if(isnotnull(base_search_id),"",base_search) | search "aggregate_thresholds.thresholdLevels{}.severityLabel"!="" "aggregate_thresholds.thresholdLevels{}.thresholdValue"!="" | rename service_title as Service "aggregate_thresholds.baseSeverityLabel" as "Base Threshold" "aggregate_thresholds.thresholdLevels{}.severityLabel" as "Thresholds" "aggregate_thresholds.thresholdLevels{}.thresholdValue" as "Threshold Values" title as KPI description as Description unit as Unit urgency as "Importance Score" | table Service KPI Description "Base Threshold" Thresholds "Threshold Values" "Importance Score" | join type=outer Service [| inputlookup itsi_entities | fields services._key title | rename services._key as services title as host | mvexpand services | lookup service_kpi_lookup _key as services | stats list(host) as host by title | eval host=mvjoin(host, ",") | rename title as Service] ... View more

A search like this will also give you an output that would allow you to dump a csv or practically clone a service tree. Replace <service_title> with the services you want to clone Replace <info_field> with any service info fields you need to use Replace <old> and <new> at the end to make new service names Use the "Create Service" Import from Search option with this search to make a clone of your service tree. | getservice | search title IN ("<service_title>*","<service_title>*") | fillnull value="none" services_depends_on base_service_template_id | fields title services_depends_on base_service_template_id | rex field=services_depends_on "serviceid=(?<serviceid>.*)~~~" | fillnull value="none" serviceid | mvexpand serviceid | join type=outer serviceid [| `service_kpi_list` | fields serviceid service_name] | stats list(service_name) as dependent_services by title base_service_template_id | eval dependent_services=mvjoin(dependent_services, ",") | rename title as service_name base_service_template_id as template_id | join type=outer template_id [| rest splunk_server=local /servicesNS/nobody/SA-ITOA/itoa_interface/base_service_template report_as=text | eval value=spath(value,"{}") | mvexpand value | eval info_fields=spath(value,"informational.fields{}"), template_id=spath(value, "_key"), template_name=spath(value, "title") | fields template_id template_name] | join type=outer service_name [| inputlookup itsi_entities | fields services._key title | rename services._key as services title as host | mvexpand services | lookup service_kpi_lookup _key as services | stats list(host) as host by title | eval host=mvjoin(host, ",") | rename title as service_name] | makemv delim="," host | mvexpand host | join type=outer host [| rest splunk_server=local /servicesNS/nobody/SA-ITOA/itoa_interface/entity report_as=text | eval value=spath(value,"{}") | mvexpand value | eval info_fields=spath(value,"informational.fields{}"), entity_id=spath(value, "_key"), entity_title=spath(value, "title"), entity_name=spath(value, "identifying_name") | appendpipe [| where isnull(field_type) | mvexpand info_fields | eval field_value = spath(value,info_fields."{}"), field_type="info" | rename info_fields as field_name ] | where field_name IN ("<info_field>","<info_field>","<info_field>","<info_field>") | stats list(field_value) as field_value by field_name entity_name | eval field_value=mvjoin(field_value,",") | eval {field_name}=field_value | stats latest(<info_field>) as <info_field> latest(<info_field>) as <info_field> latest(<info_field>) as <info_field> by entity_name | rename entity_name as host] | fields - template_id | eval service_name=replace(service_name,"<old>","<new>"),dependent_services=replace(dependent_services,"<old>","<new>") ... View more

A search like this will also give you an output that would allow you to practically clone a service tree Replace <service_title> with the services you want to clone Replace <info_field> with any service info fields you need to use Replace <old> and <new> at the end to make new service names Use the "Create Service" Import from Search option with this search to make a clone of your service tree. | getservice | search title IN ("<service_title>*","<service_title>*") | fillnull value="none" services_depends_on base_service_template_id | fields title services_depends_on base_service_template_id | rex field=services_depends_on "serviceid=(?<serviceid>.*)~~~" | fillnull value="none" serviceid | mvexpand serviceid | join type=outer serviceid [| `service_kpi_list` | fields serviceid service_name] | stats list(service_name) as dependent_services by title base_service_template_id | eval dependent_services=mvjoin(dependent_services, ",") | rename title as service_name base_service_template_id as template_id | join type=outer template_id [| rest splunk_server=local /servicesNS/nobody/SA-ITOA/itoa_interface/base_service_template report_as=text | eval value=spath(value,"{}") | mvexpand value | eval info_fields=spath(value,"informational.fields{}"), template_id=spath(value, "_key"), template_name=spath(value, "title") | fields template_id template_name] | join type=outer service_name [| inputlookup itsi_entities | fields services._key title | rename services._key as services title as host | mvexpand services | lookup service_kpi_lookup _key as services | stats list(host) as host by title | eval host=mvjoin(host, ",") | rename title as service_name] | makemv delim="," host | mvexpand host | join type=outer host [| rest splunk_server=local /servicesNS/nobody/SA-ITOA/itoa_interface/entity report_as=text | eval value=spath(value,"{}") | mvexpand value | eval info_fields=spath(value,"informational.fields{}"), entity_id=spath(value, "_key"), entity_title=spath(value, "title"), entity_name=spath(value, "identifying_name") | appendpipe [| where isnull(field_type) | mvexpand info_fields | eval field_value = spath(value,info_fields."{}"), field_type="info" | rename info_fields as field_name ] | where field_name IN ("<info_field>","<info_field>","<info_field>","<info_field>") | stats list(field_value) as field_value by field_name entity_name | eval field_value=mvjoin(field_value,",") | eval {field_name}=field_value | stats latest(<info_field>) as <info_field> latest(<info_field>) as <info_field> latest(<info_field>) as <info_field> by entity_name | rename entity_name as host] | fields - template_id | eval service_name=replace(service_name,"<old>","<new>"),dependent_services=replace(dependent_services,"<old>","<new>")   ... View more

I found a couple of things you can do here 1. Add the Entity Lookup Field from your correlation search here: That will give you whatever you evaluate entity_title too in your search as the impacted entity in your KPI 2. Just add the entity_key field to your lookup, this automatically adds any entities to the impacted entities for the KPI, though it won't add pseudo entities such as a combined field like host:disk ... View more

I was having the same trouble, even after adding the entity_title field to my correlation search. I fixed it by also adding the entity_key field. ... View more

Thanks worshamn, you set me on the right track, I had initially tried distributing the nlp app to my cluster nodes via the master node, but of course that went into etc/slave_apps. I since copied the nlp app the the indexers under etc/apps and the app has started working and stopped complaining. The difference between my 2 search heads the working one and the new one that was looking for this app on the indexers is the old one is Splunk 7.1.3 and the new one is 7.3 So for those who are interested there is definitely a difference from 7.3 in the way search works, whether it stays local or not, as my 2 servers have no difference in the config only Splunk version. So it appears this problem occurred as of 7.3 ... View more

I have finally managed to figure out how to make this work, would be useful if there was a small section in the instructions to explain this part of it for those who have no experience with mapping or creating kml/kmz files What I was trying to do was use an image of a map/polygon area and overlaying it on google earth, then saving as a kml file. This method did not give me sufficient content in the kml file to use in the maps+ app, ie polygon co-ords I instead created each area polygon manually in google earth and then saved the kml, this works fine though very time consuming. ... View more

I also had this issue, did the above, didn't work, was told to add the new role to etc/apps/search/metadata/local.meta where the user role is and it now works fine. It's just a permissions issues ... View more

Hi Nik, can this be used to just refresh a single panel rather than the entire dashboard? Regards Peter ... View more