Splunk IT Service Intelligence

Why is my ITSI search showing no results?

TheJagoff
Communicator

Hello,

I am attempting to make a KPI with the following search:

index=demo sourcetype=access_combined action=purchase|bucket _time span=5m|stats count  by _time

I get the following results (In search)

_time                                           purchased
2017-08-09 17:10:00                             75
2017-08-09 17:05:00                             122
2018-08-09 17:00:00                             89

When in ITSI with the threshold field as "count" , Calculating Average per entity, Average of aggregate over the last 15 minute(s) every 15 minute(s) - I get No Results Found...

What am I doing incorrectly?

Thanks in advance.

0 Karma
1 Solution

TheJagoff
Communicator

Again, I'll answer my own question - since I had Split on Entities as "Host" - that needs to be in the search statement.
To correct this, I did the following:
index=demo sourcetype=access_combined action=purchase|bucket _time span=5m|stats count by _time host

It now works...

View solution in original post

TheJagoff
Communicator

Again, I'll answer my own question - since I had Split on Entities as "Host" - that needs to be in the search statement.
To correct this, I did the following:
index=demo sourcetype=access_combined action=purchase|bucket _time span=5m|stats count by _time host

It now works...

Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...