Hi, I'm working with the Splunk Infrastructure Monitoring Add-on, collecting information from Splunk Observability Suite (aka SignalFX) on ITSI, using the "sim flow". I'm trying to build KPI Base searches using this command and the information that the add-on is collecting. When I execute the following query: | sim flow query="data('cpu.utilization', filter=filter('host', '*')).publish()" From the events of this result, some of the events related to X hosts have a variable AWSUniqueId that I'd like to obtain. For other hosts this variable doesn't exist and so, it doesn't appear in the event. Therefore, I've tried with the following simple query: | sim flow query="data('cpu.utilization', filter=filter('host', '*')).publish()" | chart values(AWSUniqueId) as AWSUniqueId by host But sometimes I receive all the information (with the correlation of the values), and other times it just shows all the column of AWSUniqueId with empty values, even though if I check on the events the parameter is there. It looks strange since if I just execute the query sometimes it gives the results and other times don't. Has anybody faced this same issue? Could it be a bug on the add-on? Or is not allow what I'm trying to build with this data? Thanks in advance! Best Regards, Raquel ... View more

Hi, I'm configuring the action rule when an alert is raised on ITSI and I'd need to add the time in the message or the subject of the email sent. I've seen the following fields: $result.start_time$ $result.last_time$ but the time appears in epoch, something like this: 1607006402.725 I've seen that on the $result.orig_raw$ field the beginning is the time when the event start, but there is so much information after. (Example: "result.orig_raw=12-04-2020 09:30:02 KPI alert..." Would it be possible to extract the time in a format like "dd-mm-yyyy hh:mm:ss" with a different field? If not, could I extract from the orig_raw the beginning of the text? Or transform any of the start_time or last_time values to that format? Cheers! ... View more

Hi all, I received the following error when I try to apply adaptive threshold in one KPI of one service where I enabled the backfill: "The following problems were encountered: insufficient data in ITSI summary index for policies ['Weekdays, 4 PM', 'Weekdays, 9 AM', 'Weekdays, 2 PM', 'Weekdays, 12 PM', 'Weekdays, 10 AM', 'Weekdays, 3 PM', 'Weekdays, 7 AM', 'Weekdays, 8 AM', 'Weekdays, 1 PM', 'Weekdays, 6 PM', 'Weekdays, 5 PM', 'Weekdays, 11 AM']" even though I know it should be data in the system. If I search by the index itsi_summary I see only information from the moment when the backfill was activated (1 day ago) and not from the last 7 days. I've also checked I have the rights for it. What else could I check to troubleshoot this issue? Thanks in advance! ... View more