KPI reference for the Content Pack for Monitoring Splunk as a Service

These tables list the KPIs used to monitor the health of your Splunk hosts in the Content Pack for Monitoring Splunk as a Service.

Splunk Instance Metrics Template

The following table lists the granularity of the KPIs in the Splunk Instance Metrics service template:

KPI	KPI search schedule and lookback time
Error count	5 min/5 min lookback
Erroring Hosts	5 min/5 min lookback
Installed Apps	15 min/15 min lookback
Login Errors	5 min/5 min lookback
SSL Errors	5 min/5 min lookback

Splunk OS Metrics Template

The following table lists the granularity of the KPIs in the Splunk OS Metrics service template:

KPI	KPI search schedule and lookback time
Average Disk Read I/O	5 min/5 min lookback
Average Disk Write I/O	5 min/5 min lookback
Average I/O Service Time	5 min/5 min lookback
Average I/O Wait Time	5 min/5 min lookback
CPU Cores	5 min/5 min lookback
CPU Normalized Load	5 min/5 min lookback
CPU Utilization	15 min/15 min lookback
Disk Read Kpbs	5 min/5 min lookback
Disk Used	5 min/5 min lookback
Disk Utilization	5 min/5 min lookback
Disk Write Kpbs	5 min/5 min lookback
Installed Memory	5 min/5 min lookback
Memory Utilization	5 min/5 min lookback

Splunk ES Metrics

The following table lists the granularity of the KPIs in the Splunk ES Metrics service:

KPI	KPI search schedule and lookback time
Average Correlation Run Time	5 min/5 min lookback
Correlation Lag Time	5 min/5 min lookback
Max Correlation Run Time	5 min/5 min lookback

Splunk Forwarder

The following table lists the granularity of the KPIs in the Splunk Forwarder service:

KPI	KPI search schedule and lookback time
Connection Count	5 min/5 min lookback
Forwarder Count	5 min/5 min lookback
Forwarder Throttled	5 min/5 min lookback
GUIDs Per Hostname	15 min/15 min lookback
TCP EPS	5 min/5 min lookback
TCP Kbps	5 min/5 min lookback
Throughput	5 min/5 min lookback

Splunk Indexer Buckets

The following table lists the granularity of the KPIs in the Splunk Indexer Buckets service:

KPI	KPI search schedule and lookback time
Cold Buckets	5 min/5 min lookback
Hot Buckets	5 min/5 min lookback
Thawed Buckets	5 min/5 min lookback
Total Buckets	15 min/15 min lookback
Warm Buckets	5 min/5 min lookback

Splunk Indexer Cluster Metrics

The following table lists the granularity of the KPIs in the Splunk Indexer Cluster Metrics service:

KPI	KPI search schedule and lookback time
Cluster Health Check	5 min/5 min lookback
Cluster Manager Slow Response	5 min/5 min lookback
Cluster Peer Slow Response	5 min/5 min lookback

Splunk Indexer Data

The following table lists the granularity of the KPIs in the Splunk Indexer Data service:

KPI	KPI search schedule and lookback time
Data Truncation Issues	5 min/5 min lookback
Future Timestamps	5 min/5 min lookback
Line breaking Issues	5 min/5 min lookback
Parsing Issues	5 min/5 min lookback

Splunk Indexer Index Metrics

The following table lists the granularity of the KPIs in the Splunk Indexer Index Metrics service:

KPI	KPI search schedule and lookback time
Events Indexed	5 min/5 min lookback
Per Host Throughput	5 min/5 min lookback
Per Index Throughput	5 min/5 min lookback

Splunk Indexer Queues

The following table lists the granularity of the KPIs in the Splunk Indexer Queues service:

KPI	KPI search schedule and lookback time
Aggregate Queue Fill	5 min/5 min lookback
Current Time in Queue	5 min/5 min lookback
Current Queue Size	5 min/5 min lookback
Indexing Queue Fill	5 min/5 min lookback
Max Time in Queue	5 min/5 min lookback
Max Queue Size	5 min/5 min lookback
Parsing Queue Fill	5 min/5 min lookback
Typing Queue Fill	5 min/5 min lookback

Splunk Indexer Search Metrics

The following table lists the granularity of the KPIs in the Splunk Indexer Search Metrics service:

KPI	KPI search schedule and lookback time
Average Historical Searches	5 min/5 min lookback
Average Real-time Searches	5 min/5 min lookback
Enqueue Searches	5 min/5 min lookback
Max Historical Searches	5 min/5 min lookback
Max Real-time Searches	5 min/5 min lookback
Max Running Searches	5 min/5 min lookback
Max Search Runtime	5 min/5 min lookback
Skipped Searches	5 min/5 min lookback

Splunk ITSI Metrics

The following table lists the granularity of the KPIs in the Splunk ITSI Metrics service:

KPI	KPI search schedule and lookback time
Average Runtime	5 min/5 min lookback
Index Lag	5 min/5 min lookback
Indexed Events	5 min/5 min lookback
ITSI Internal Search Failed	5 min/5 min lookback
ITSI Log Errors	5 min/5 min lookback
ITSI Log Warnings	5 min/5 min lookback
ITSI Refresh Queue Data Count	5 min/5 min lookback
KPI Count	5 min/5 min lookback
KPI Search Failed	5 min/5 min lookback
Max Runtime	5 min/5 min lookback

Splunk License Metrics

The following table lists the granularity of the KPIs in the Splunk License Metrics service:

KPI	KPI search schedule and lookback time
License Usage by Index	5 min/5 min lookback
License Usage by Indexer	5 min/5 min lookback
License Usage by Sourcetype	5 min/5 min lookback
Licensed Event by Indexer	5 min/5 min lookback

Splunk Search Head Cluster

The following table lists the granularity of the KPIs in the Splunk Search Head Cluster service:

KPI	KPI search schedule and lookback time
Bundle Replication Failure	5 min/5 min lookback
SHC Health Check	5 min/5 min lookback

Splunk Search Head Users

The following table lists the granularity of the KPIs in the Splunk Search Head Users service:

KPI	KPI search schedule and lookback time
Average Runtime	5 min/5 min lookback
Max Runtime	5 min/5 min lookback
User Count	5 min/5 min lookback

Splunk Search Metrics

The following table lists the granularity of the KPIs in the Splunk Search Metrics service:

KPI	KPI search schedule and lookback time
Average Search Runtime	5 min/5 min lookback
Executed Searches	5 min/5 min lookback
Execution Latency	5 min/5 min lookback
Max Search Runtime	5 min/5 min lookback
Skipped Count	5 min/5 min lookback
Skipped Searches	5 min/5 min lookback
Suppressed Count	5 min/5 min lookback