Splunk ITSI

Splunk ITSI Episodes count for a Service inside the glasstable

inventsekar
SplunkTrust
SplunkTrust

Hi All.., 

Pretty new to ITSI and i have created a GlassTable with KPI Services - CPU, Memory and Disk Utilization. 

new-itsi-disk-cpu.jpg

now i would like to add the number of episodes for the service CPU, but i am not sure how to get the number of episodes for a given service. any ideas, suggestions please. 

 

This below image shows the number of episodes occurred for memory_usage. Here we have grouped the events... so i need this count to be appeared on the glass table. 

new-itsi-episodes.jpg

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
Labels (2)
0 Karma

eduncan
Splunk Employee
Splunk Employee

You just need to create a KPI inside of each service that counts NEAPS.  Something like this for your KPI search:  

index=itsi_grouped_alerts service_name="Put your service name here"

 

For your split by field you want to use the itsi_group_id

 

For your calculation use distinct count or count.  Then you just drag that KPI to your glass table.

 

inventsekar
SplunkTrust
SplunkTrust

Sure, will try this and update you back. Thanks.

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...