Splunk IT Service Intelligence: How can I setup Email Alerts for individual KPIs or total "Service Health"?

[r34220]

How can I setup Email Alerts for individual KPIs or total "Service Health" on Splunk IT Service Intelligence (ITSI)?

[rossl_splunk · Accepted solution]

You first want to create a Multi-KPI-Alert. You can read about that at http://docs.splunk.com/Documentation/ITSI/2.4.1/User/CreateMulti-KPIAlerts

Once you create the alert you can configure email alerting by doing the following:

1. Go to the navigation bar and select configure->correlation searches.
2. Find the Multi-KPI-Alert that you just created
3. Press Edit->By correlation search editor
4. Expand the "Advanced Options" panel.
5. Check "Send email"
6. Fill out the required fields for the email action.
7. Save