Splunk IT Service Intelligence

ITSI and weekly/monthly KPI

jwillaime
Explorer

Hello,

I'm currently using ITSI to monitor some services from which the KPI are calculated over small time window (15 minutes by default). I see that the calculation window of the KPI base search creation tool do not have any option than 24 hours.

I would like to know if it is possible to have a KPI calculated over a bigger time window (eg, a week or a month). I have the feeling that that is not the purpose of ITSI, but I'm curious.

Thank you.

0 Karma

yannK
Splunk Employee
Splunk Employee

As KPI are summary searches, there are no use cases for reporting on pooling of more than 24h.

if you want to report on data from a larger timerange, you could precalculate it using another scheduled search, and summarize the results (or use a lookup), then carve a custom KPI to retrieve it, and add fake _time fields.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...