All Apps and Add-ons

ITSI: two KPIS with critical severity not working

jaimelopez
Explorer

Hello all,

I am trying to configure a service in ITSI with two KPIS ("A", "B") with the most severity (11).

When I do the test inside the configuration of the service it works perfectly, if any of these KPIS get critical status, global health score of the service gets 0 (critical).

But in the practice, when the service is running with real data, only when "A" gets critical, global health score of the service changes to critical, but it does not happens with "B". I seems that system gives more importance to "A" than "B".

I would like to ask if someone is facing the same issue, if someone knows that this is a real limitation of ITSI (although in testing mode when setting configuration of service it works well) and if someone has a solution for this.

Thanks very much in advance for the help,

0 Karma

lloydknight
Builder

Hello @jaimelopez

Aside from both A and B's KPI Importance value set to 11, may I know if you've set entities on them and what are the thresholds of A and B KPI?

While the condition on "KPI A" was met while "KPI B" did not, my hunch is that they both have different thresholds set and should you have defined entities for both KPIs, did you split the aggregation of data by entities?

0 Karma

jaimelopez
Explorer

Hello @lloydknight ,
Both KPIS have as entities the different servers and the thresholds are the same:
Base severity: critical
Critical: 0
Normal:1

In a test way with the simulator it works as expected but not when conditions are met with real data.

Best regards,

Thanks

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...