Splunk® IT Service Intelligence

Administration Manual

Acrobat logo Download manual as PDF

Splunk IT Service Intelligence (ITSI) version 4.11.x will reach its End of Life on December 6, 2023. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see Before you upgrade IT Service Intelligence.
This documentation does not apply to the most recent version of Splunk® IT Service Intelligence. Click here for the latest version.
Acrobat logo Download topic as PDF


The following are the spec and example files for threshold_labels.conf.


# Copyright (C) 2005-2020 Splunk Inc. All Rights Reserved. 
# This file contains all possible attribute/value pairs for configuring settings
# for severity-level thresholds. Use this file to configure
# threshold names and color mappings.
# To map threshold names and colors, place a threshold_label.conf in 
# $SPLUNK_HOME/etc/apps/itsi/local/. For examples, see threshold_label.conf.example.
# To learn more about configuration files (including precedence) see the documentation 
# located at http://www.splunk.com/base/Documentation/latest/Admin/Aboutconfigurationfiles
# CAUTION: You can drastically affect your Splunk installation by changing any settings in
# this file other than the colors. Consult technical support (http://www.splunk.com/page/submit_issue)
# if you are not sure how to configure this file.


color = <string>
* A valid color code.
* Required.

lightcolor = <string>
* A valid color code to display for Episode Review "prominent mode". 
* When you view Episode Review in prominent mode, the entire row is colored
  rather than just the colored band on the side. 
* Required.

threshold_level = <integer>
* A threshold level that is used to create an ordered list of the labels.
* For example, if you set the 'Normal' threshold level to "1", it appears 
  first when the levels are listed in the UI. 
* Optional.

health_weight = <integer>
* The weight or importance of this status. 
* This value should be between 0 and 1. 
* In general, regular levels like Normal and Critical have a weight of "1", while 
  less important levels like Maintenance and Info have a weight of "0".
* Required.

health_min = <integer>
* The minimum threshold value. 
* This value must be a number between 0 and 100. 0 and 100 are inclusive but 
  the minimum threshold value is exclusive.
* Required.

health_max = <integer>
* Themaximum threshold value.
* This value must be a number between 0 and 100. 0 and 100 are inclusive but 
  the maximum threshold value is exclusive.
* Required.

score_contribution = <integer>
* The number, traditionally from 0 to 100, that this particular level will
  contribute towards health score calculations.
* Required.


# Copyright (C) 2005-2020 Splunk Inc. All Rights Reserved.
# This is an example threshold_labels.conf. Use this file to
# configure settings for severity-level thresholds. 
# To use one or more of these configurations, copy the color code
# into threshold_labels.conf in $SPLUNK_HOME/etc/apps/itsi/local.  
# You must restart Splunk to enable configurations.
# To learn more about configuration files (including precedence) please see
# the documentation located at
# http://docs.splunk.com/Documentation/ITSI/latest/Configure/ListofITSIconfigurationfiles
# This example alert includes showing raw events at selected time buckets, 
# showing raw events from a displayed time range, showing KPI events for 
# a host, and showing all events for a host. 
# This file contains examples of brighter severity colors, with "Normal" severity 
# being replaced with "Low" severity. 

color = #6AB7C7
threshold_level = 1

color = #65A637
threshold_level = 2

color =  #FAC51C
threshold_level = 3

color = #F7902B
threshold_level = 4

color = #D85D3C
threshold_level = 5

Last modified on 16 September, 2021

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.11.0, 4.11.1, 4.11.2, 4.11.3, 4.11.4

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters