Splunk IT Service Intelligence

Can I use Rest API command into ITSI?

htramtran83
Explorer

I want to find the concurrent search limit (max_rt_searches/max_hist_scheduled_searches...)

| rest "/services/server/status/limits/search-concurrency?cluster_wide_quota=1"

| stats max(max_hist_searches) as max_hist_searches, max(max_hist_scheduled_searches) as max_hist_scheduled_searches, max(max_rt_searches), as max_rt_searches, max(max_rt_scheduled_searches) as max_rt_scheduled_searches, max(max_auto_summary_searches) as max_auto_summary_searches

| fields max_hist_searches, max_hist_scheduled_searches,

max_rt_searches, max_rt_scheduled_searches,
max_auto_summary_searches,

I cannot create KPI inside ITSI. Anyone can help me explain?

0 Karma

yannK
Splunk Employee
Splunk Employee

ITSI KPI searches need to preserve necessary fields to work,

As mentioned here: https://docs.splunk.com/Documentation/ITSI/latest/Configure/AddKPIs#Define_a_source_search_from_an_a...

The ad hoc search string that you create. This is the event gathering search for the KPI.
Note: The use of transforming commands, the mstats command, the gettime macro, or time modifiers in your KPI search is not recommended as this may cause issues with KPI backfill, the display of raw data on ITSI views such as glass tables and deep dives that allow you to run KPI searches against raw data, and the KPI threshold preview.

in your case, you need to preserve the field _time. (maybe others, depending of your filters/entities lookup mapping etc...)

try to add something like that to your stats command

| stats first(_time) AS _time
and to your fields
| fields _time ...

0 Karma

atsviatkou_splu
Splunk Employee
Splunk Employee

Do you want to track value of max_rt_searches/max_hist_scheduled_searches as a KPI?

In a ITSI service create/edit UI you can do KPI > New > Generic KPI
give a name, click next add Ad hoc Search such as

| rest "/services/server/status/limits/search-concurrency?cluster_wide_quota=1"
| stats max(max_hist_searches) as max_hist_searches, 
        max(max_hist_scheduled_searches) as max_hist_scheduled_searches,
        max(max_rt_searches), as max_rt_searches,
        max(max_rt_scheduled_searches) as max_rt_scheduled_searches,
        max(max_auto_summary_searches) as max_auto_summary_searches
| eval rt_search_multiplier=max_rt_searches/max_hist_scheduled_searches
| fields rt_search_multiplier

Use rt_search_multiplier as Threshold Field

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...