Splunk ITSI

ITSI summary

P2kumari
Loves-to-Learn Lots

what is the reason when we change the adhoc search of a KPI to base search, the logs in index=itsi_summary shows that the KPI is using both the searches ( adhoc as well as base search) even after the adhoc search has been deleted from the KPI in splunk itsi.

Labels (2)
Tags (1)
0 Karma

esnyder_splunk
Splunk Employee
Splunk Employee

This KPI should be removed from the base search. I suggest filing a support ticket.

0 Karma
Get Updates on the Splunk Community!

SOC Modernization: How Automation and Splunk SOAR are Shaping the Next-Gen Security ...

Security automation is no longer a luxury but a necessity. Join us to learn how Splunk ES and SOAR empower ...

Ask It, Fix It: Faster Investigations with AI Assistant in Observability Cloud

  Join us in this Tech Talk and learn about the recently launched AI Assistant in Observability Cloud. With ...

Index This | How many sides does a circle have?

  March 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...