Use the Health Check dashboard
The ITSI Health Check dashboard provides basic statistics about your environment.
Dashboard panels
Panel | Description |
---|---|
Splunk Server Information | Basic server information for each host. |
ITSI Migration Status | The current version of ITSI and the KV store. These versions should be the same. |
ITSI Upgrade Readiness | Checks whether any service templates are currently syncing. If so, it is not safe to upgrade. Click Configure > Service Templates to see the current sync status of your service templates. |
Basic ITSI Information | For each host, lists the number of services, searches, and entities, as well as KV store and HEC information. |
KPI Base Search Usage Summary | The number of KPIs using each base search. |
KV Store Collections | All ITSI KV store collections, the number of objects in each collection, acceleration information, and the collection size. If a collection is approaching the limit, consider trimming it to retain three months or less of metadata. For instructions, see Trim down notable event KV store collections in the Event Analytics manual. This functionality is not part of ITE Work, and applies only to ITSI. |
Concurrent Searches | All ITSI searches currently running. |
Interesting Indexes | All ITSI indexes and their statistics. |
Interesting Searches | Real-time searches that ITSI runs. itsi_event_grouping handles event grouping for notable event aggregation policies. itsi_mad_context and itsi_mad_cohesive_context handle metric anomaly detection. The searches exist in savesearches.conf. If any search jobs are failed or not running, this could indicate a problem.
|
KPI Performance | Basic performance information for each KPI in your ITSI instance. Any failed or skipped searches indicate a problem. The runtime headroom percentage indicates how much time has been used up out of the search's frequency. A headroom percentage close to 100 is best, and a value closer to 0 indicates a problem. |
Saved search Error Messages | Lists names of saved search with error messages that include details about count, average run time, message key, and error messages. |
Not Executed Searches (In last 1 hour) | The number of searches that were not executed in the last hour. |
Refresh Queue Runtimes | Statistics for the refresh queue. The refresh queue ensures data integrity and eventual consistency of your ITSI configuration. It runs as a single instance. |
Refresh Queue Failed Jobs | The number of failed jobs in the refresh queue. Click a failed job to drill down to the logs. |
ITSI Log Messages (deduplicated) | Warning and error messages in the ITSI or logs. The messages are deduplicated so you won't see the same error multiple times. |
Check for Duplicate Entity Aliases | Lists the entity aliases (field-value pairs) identifying more than one entity. |
Configure multiple ITE Work deployments to use the same indexing layer | Use the Service Statistics Dashboard |
This documentation applies to the following versions of Splunk® IT Essentials Work: 4.16.0 Cloud only
Feedback submitted, thanks!