Love the code but  it seemed to only do one value in the lookup. What if that event (comparing host in table to event) has 2 fields that don't have null values that need compared to the 2 in the lookup table.  Like in your example they all had the same columns, 3 fields were in the table and the event had 4 different fields. But I have something to start playing with. I will continue to play with this while onboarding other stuff. Look forward to hearing from you again. ... View more

I know this is an old post. You probably already figured this out. Since there are new people who look at these feeds, I figured I would answer. At this point there is no way to disable a single KPI. You can put the whole service in maintenance to stop the KPI's however, it will stop all of them on that service. Any other changes you would do to stop it would mess with the configuration. My suggestion is that if you feel like there should be an enhancement to the maintenance area that allows individual KPI's to be disabled, then submit the enhancement for a vote. Have all your friends and coworkers vote on it. ... View more

There is no way to automatically shut off the correlation searches based on time. It is a manual process. You can only put the services and entities into maintenance.  https://docs.splunk.com/Documentation/ITSI/4.2.1/Configure/MaintenanceWindows Even though this is an old post, I figured I would answer it because there are a lot of new people coming into the application.   Also, If this is something you feel needs to be a feature of the maintenance process, then put in an enhancement. It is voted on, so get all your friends and coworkers to vote.  ... View more

We are having the same issue.  We have a nagios correlation search for multiple teams. Each team have about 20+ services. There are Parent services but I was told the parent service won't include the children. So how do you put the services on the correlation search. That's over 100 services... I saw where you talked about doing the NEAP. What do you need to add to the correlation search to get the in_maintenance or this said in_mm field to show as a field so you can have it available to use in the NEAP.   Thanks ... View more