Splunk® IT Service Intelligence

Administration Manual

Acrobat logo Download manual as PDF

Splunk IT Service Intelligence version 4.0.x reached its End of Life on January 19, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see Plan an upgrade of IT Service Intelligence.
This documentation does not apply to the most recent version of Splunk® IT Service Intelligence. Click here for the latest version.
Acrobat logo Download topic as PDF

Create KPI threshold time policies in ITSI

ITSI lets you create KPI threshold time policies with threshold values that change over time. You can use KPI threshold time policies to accommodate normal variations in usage across your services and improve the accuracy of KPI and service health scores. For example, if your organization's peak activity is during the standard work week, you might create a KPI threshold time policy that takes into account higher levels of usage during work hours, and lower levels of usage during off-hours and weekends.

You can only have one active time policy at any given time. When you create a new time policy, the previous time policy is overwritten and cannot be recovered.

Use KPI threshold templates

ITSI provides a set of 32 default thresholding templates that you can use to build your time policies. You can select templates with different time block combinations, such as work hours, off hours, weekends; AM/PM; 3 hour block; 2 hour block: and so on.

Thresholding templates are static or adaptive. Static templates let you create time policies that do not change after you configure them. Adaptive templates let you create time polices that generate thresholds dynamically and update daily based on changes in your data.


  1. In the KPIs list, select the specific KPI for which you want to set a threshold time policy.
  2. Expand the Thresholding panel.
  3. Select Use Thresholding Template. Then select a thresholding template, such as "3-hour blocks every day (adaptive/stdev)." Selecting an adaptive template automatically enables Adaptive Thresholding and Time Policies.
    The Preview Aggregate Thresholds window opens. ITSI backfills the preview with aggregate data from the past 7 days. If there is data in the summary index it loads the summary data, otherwise it loads raw data. Loading raw data can take some time.
  4. Expand the Configure Thresholds for Time Policies panel.
  5. Select a time policy block, then click Apply Adaptive Thresholding. Make sure to use the correct Policy type. Policy types for adaptive thresholds include Standard deviation, Quantile, and Range.
    ITSI generates your new threshold time policy, which you can view in the Preview Aggregate Thresholds window. Adaptive thresholds update once daily at midnight.
  6. Click Save.

TIme polices cannot overlap. If you attempt to create a policy that overlaps with another policy, a validation error appears.

Create custom threshold time policies

You can create custom threshold time policies tailored to your specific monitoring needs and variations in the usage of your services. You can also enable adaptive thresholding for custom time policies, and set a training window over which historical KPI data is analyzed for adaptive threshold adjustments.

Time policies support time zone offsets of 15, 30, and 45 minutes for compatibility with non-hourly time zones (such as (GMT+05:30) Chennai, Kolkata, Mumbai, New Delhi). This allows users in non-hourly time zones to accurately apply time policies created by users in hourly time zones.


  1. In the KPIs list, select the KPI for which you want to set a threshold time policy.
  2. Expand the Thresholding panel.
  3. Select Set Custom Thresholds.
  4. For Enable Time Policies, select Yes.
  5. (Optional) Click Yes to enable adaptive thresholding. Set the Training Window, which is the time window over which historical KPI data is analyzed for adaptive threshold updates.
  6. Expand the Configure Thresholds for Time Policies panel.
  7. Click Add Time Policy.
  8. Configure your custom time policy:
    Field Description
    Title The name of the threshold time policy.
    Start Time (HH:MM) The specific hour and minute at which the threshold time policy begins. Note that the threshold start time supports 15, 30, and 45 minute offsets for compatibility with off-hour time zones.
    Duration The number of hours to which the threshold applies.
    Repeat The specific days of the week to which the time policy applies.
  9. Click Add.
  10. (Optional) To apply adaptive thresholding to this specific time policy, select the policy and click Apply Adaptive Thresholding.

    Policy types that support adaptive thresholds include Standard deviation, Quantile, and Range.

For more information about how ITSI handles time zones, see Time zone handling in this manual.

Create a new KPI threshold template

Create a custom KPI threshold template with specific time block combinations that are tailored to your business case.


To create a new KPI threshold template, you must have write permissions for the Global team. You must also possess the appropriate capabilities to be able to read, create, or delete KPI threshold templates.


  1. In the ITSI main menu, click Configure > KPI Threshold Templates.
  2. Click Create Threshold Template.

    If your role does not have write access to the Global team, you will not see the Create Threshold Template option.

  3. (Optional) Enter a title and description.
  4. KPI threshold templates can only exist in the Global team. The Team cannot be changed.
  5. Click Create.
  6. Select the template you just created in the KPI Threshold Templates lister page.
  7. Select a Preview Service and Preview KPI. For example, Database Service and CPU Utilization %, respectively.
  8. (Optional) For Enable Adaptive Thresholding, click Yes to enable time varying thresholds that update periodically based on historical KPI data.
    • For Training Window select the time period over which to evaluate KPI data for adaptive thresholding.
  9. Select Aggregate Thresholds for the preview to display the single aggregate search value. Or, select Per Entity Thresholds for the preview to display KPI values for each individual entity against which the KPI runs.
  10. Expand the Configure Thresholds Time Policies panel.
  11. Define a time policy for this template. Click Save.

You can now apply your custom thresholding template to any number of KPIs.

Edit thresholding templates

ITSI provides an editing page where you can modify any existing thresholding templates. For example, you might want to change the days and hours for a specific time policy, change the policy type, or apply adaptive thresholding.


  1. Select a KPI in the service definition.
  2. Expand the Thresholding panel.
  3. Select Use Thresholding Template and select the template you want to edit.
  4. Click Edit Template.
  5. Make your modifications to the thresholding templates.
  6. Click Save.
Last modified on 07 December, 2018
Set KPI importance values in ITSI
Apply adaptive thresholds to a KPI in ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters