Splunk IT Service Intelligence

Splunk Infrastructure Monitoring add-on with ITSI



I'm working with the Splunk Infrastructure Monitoring Add-on, collecting information from Splunk Observability Suite (aka SignalFX) on ITSI, using the "sim flow". I'm trying to build KPI Base searches using this command and the information that the add-on is collecting.

When I execute the following query:

| sim flow query="data('cpu.utilization', filter=filter('host', '*')).publish()"

From the events of this result, some of the events related to X hosts have a variable AWSUniqueId that I'd like to obtain. For other hosts this variable doesn't exist and so, it doesn't appear in the event.

Therefore, I've tried with the following simple query:
| sim flow query="data('cpu.utilization', filter=filter('host', '*')).publish()"
| chart values(AWSUniqueId) as AWSUniqueId by host

But sometimes I receive all the information (with the correlation of the values), and other times it just shows all the column of AWSUniqueId with empty values, even though if I check on the events the parameter is there. It looks strange since if I just execute the query sometimes it gives the results and other times don't. Has anybody faced this same issue? Could it be a bug on the add-on? Or is not allow what I'm trying to build with this data?

Thanks in advance!

Best Regards,

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...