Splunk IT Service Intelligence

What is difference between N/A and 0 value on kpi result?

vinayakwagh
Engager

Some KPI in service shows N/A value on default service analyzer but as soon as I change time range on default service analyzer from 12 hours to 24 hours the KPI which showing N/A as result convert to 0 and stated as normal don't know why this is happening and also can we convert N/A result value of KPI to 0 in default service analyzer.

0 Karma
1 Solution

esnyder_splunk
Splunk Employee
Splunk Employee

This is most likely due to gaps in the data - so if interval is 5 mins per KPI, but data only comes every 15 mins, then you will get gaps and N/A values. If you have selected to fill data gaps with "Null Values" in the service definition, this is probably what's going on: https://docs.splunk.com/Documentation/ITSI/latest/Configure/AddKPIs#Step_4:_Add_monitoring_calculati...

Check the ITSI Health Check dashboard "KPI Performance" panel for skipped searches. It usually happens because you're either overloading your search head with work or the search that you wrote takes so long that it is not done before the next search is scheduled to start, so it skips the next run (if it did not, you would enter an endless growth of searches that cannot finish).

View solution in original post

esnyder_splunk
Splunk Employee
Splunk Employee

This is most likely due to gaps in the data - so if interval is 5 mins per KPI, but data only comes every 15 mins, then you will get gaps and N/A values. If you have selected to fill data gaps with "Null Values" in the service definition, this is probably what's going on: https://docs.splunk.com/Documentation/ITSI/latest/Configure/AddKPIs#Step_4:_Add_monitoring_calculati...

Check the ITSI Health Check dashboard "KPI Performance" panel for skipped searches. It usually happens because you're either overloading your search head with work or the search that you wrote takes so long that it is not done before the next search is scheduled to start, so it skips the next run (if it did not, you would enter an endless growth of searches that cannot finish).

Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...