@splunk Team, In some cases I want to Skip a specific KPI calculation or Stop it from calculating its next value. its more like Maintenance mode concept but limited to KPI not at service level? Example- We had a issue with SPlunk and due to which few of Indexes were not populating due to forwarder issues or data injection . In that Case when we know that issue persist for a while rather than Reducing Importance of KPI that is change to the model , I was wondering if there is any means to stop that? I dont like the idea to touch my PROD model config( importance for these issues I need way to suppress the alert, I need if we have any other config level thing for this? Curious to know. Other EXAMPLE - Any Splunk Injection level failure will impact model calculation , how to handle these? Thanks satya Thanks ... View more

Hello ALL, I would like to know is where are anomaly detection Information is stored in ITSI?, I mean any specific Index bucket? or is that a Black Box for us?.I know it is going into "Episode review" but that will not help me . I need to pro grammatically get this information just like I get KPI score from ITSI-Summary. As I need to stop my system alerting when it detects Anomaly. Secondly, where can I find detailed information about how it is detecting Anomaly?As, I was wondering is there an option to change any setting? Thanks Satya ... View more

Hello Splunk Lovers, This question is very specific to ITSI, I would like to know how long is the system taking to calculate a Service Health score with 10 KPI's that have configured with 5 base searches in it. As I am researching on Lag time for my service to calculate health score. There are 3 pieces to this to what I understand. 1. Data coming into Splunk. I know the details. so u can ignore this. 2. Service Schedule/Frequency of Each KPI. For example for Every 5 minutes . 3. ** How long eack KPI runs and in turn and when does the service has the all the information to calculate Health Score. As this is available in "ITSI _Summary" and from where my Service Analyzer will calculate. I will happy to elaborate more if need, I tried my best to put as much I can. Ultimate I need to understand "LAG" in calculating Health Score. Thanks Satya ... View more

Here is what I found in case you were wondering what I am asking for. Point 2# looks like ITSI doesn’t understand 0 as its lower value?) 1. If we are defining threshold values in Ascending order- We are good as ( example Error Rate Threshold, where anything above 60% is Critical, while we start from 0- Normal, 10-Low,20-Medium, 40- High, So ITSI know that any number above 60 will be marked as Critical. 2. If we are defining threshold values in Descending order – We need to make sure we end up with 0. As its lowest value . Normal -6 , Low-5,Medium-4,High-3,Critical-2 ( I can’t do this , as If I have value as 1 it will say default Severity Not Critical), While I m anticipating it to know that anything below 2 until 0 should be critical . Fix - I have to say Critical-0. Then model is reflecting/report correctly as Critical failure. So, Can the model just like in Ascending case where it know its 100% max.Can it have a boundary defination for 0 is Minimum for Descending Values? Thanks Satya ... View more