Splunk ITSI

Why Can't I Edit my KPI Search Schedule?

TylerJVitale
Explorer

In ITSI, when I go to configure my KPIs, the Search Schedule option is always locked. Does anyone know why I can't change this?

Additionally, when I create a generic KPI from scratch, the Calculation Controls tab won't load, but when I save the KPI and then go back in to edit it, the tab loads. Why doesn't it ever work the first time?

esnyder_splunk
Splunk Employee
Splunk Employee

Hi Tyler, is the KPI linked to an ad hoc search? If that's the case, the search schedule and other calculations are controlled in Configure > KPI Base Searches and are therefore not configurable in the service definition.

roman3ro
Engager

I'm seeing the same issue on ITSI v 4.2.0. Did you find a fix?

0 Karma

TylerJVitale
Explorer

Splunk Support found a fix after 1.5 months, so I recommend opening a ticket with them. I don't know what the fix was

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...