Splunk® IT Service Intelligence

Service Insights Manual

Acrobat logo Download manual as PDF

Acrobat logo Download topic as PDF

Create Custom threshold windows in ITSI

Create Custom KPI threshold windows to account for time periods when your KPI threshold values may vary due to seasonal events, like holidays, in order to avoid false alerts. After creating your Custom threshold windows, your settings are automatically applied to your adaptive thresholds, and service and KPI templates. Any services or KPIs linked to a Custom threshold window display an Active badge on the Service Analyzer and Service configuration pages.


Requirement Description
ITSI roles You must have the itoa_admin or itoa_team_admin role. For more information, see Configure users and roles in ITSI in the Administration Manual.
Create services and KPIs Create services and KPIs to link to your Custom threshold windows. For more information, see Overview of creating services in ITSI and Overview of creating KPIs in ITSI.


Follow these steps to create a Custom threshold window.

Step 1. Create a Custom threshold window

  1. Select Configuration > Custom Threshold Windows from the ITSI main menu.
  2. Click Create Custom Threshold Window to create a new window.
  3. Configure the following fields for your Custom threshold window:
    Field Description
    Title The name of the Custom threshold window. Each Custom threshold window must have a unique name.
    Description (Optional) Describe your Custom threshold window.
    Schedule How often your Custom threshold window runs. Select one of the following options:
    • Does not repeat
    • Run every week
    • Run every month

    Note: If you select Does not repeat, the threshold window becomes Read-only after it completes. The Custom threshold window also becomes Read-only when it is active.

    Window start The approximate date, hour, and minute at which the Custom threshold window begins to run.
    Window start The number of days or hours to which the threshold window applies. Select up to 90 days or 2160 hours.
    Window duration The number of days or hours to which the threshold window applies. Select up to 90 days or 2160 hours.
    Select KPIs to link Select this checkbox to be redirected to the Custom threshold window configuration page, where you can select the KPIs that you want to link to your threshold window.
  4. Click Create. If the Select KPIs to link checkbox is selected, you're redirected to the Custom threshold window configuration page to add additional settings. Otherwise, your Custom threshold window is added to the list of Custom threshold window policies on the previous page.

Step 2. Apply threshold configuration

On the configuration page for your Custom threshold window, select a value that will increase or decrease the KPI threshold values by the specified percent value in the Threshold Configuration section. For example, if the range for a Low severity-level KPI threshold is set to 10-100, selecting "Increase by 10%" updates the range to map to alert values between 11-110.

Step 3. Link KPIs and services

Follow these steps to select the services and KPIs you want to link to your Custom threshold window on the Linked Services and KPIs section.

Note: Permission to edit the Custom threshold window is based on the permissions set for the KPIs and services that you link here.

  1. Click Link Services & KPIs.
  2. Select the services and KPIs that you want to link to this threshold window in the popup modal. Your Custom window configuration will apply to these services and KPIs at the time your window becomes active.
  3. Click Save.

Note: You can't link services and KPIs that are already linked to another Custom threshold window with an overlapping scheduled time period.

Example Custom threshold window use case

You want the ability to adjust the threshold configuration of your KPIs for large retail moments like Black Friday, because you notice a deviation in KPI values during this event, generating false alerts that are only the result of this seasonal spike in website visits. Although adaptive thresholds can help to account for changes in your annual business cycle, they don't account for seasonal changes outside of the 60 day business cycle (the maximum training period supported for adaptive thresholds is 60 days), such as changes caused by seasonal holiday activity.

Backup and Restore

Custom threshold windows are saved as part of a full backup of your ITSI environment.

When you restore an ITSI backup, the status (Active, Scheduled, or Completed) for your Custom threshold windows is updated based on the time that your environment is restored. For example, if your Custom threshold window was active during a backup job, but the scheduled time for your Custom threshold window to execute has passed, then the Custom threshold window's status and any linked KPIs are updated to Completed upon restore.

Last modified on 22 April, 2022
Create adaptive KPI thresholds in ITSI
Overview of deep dives in ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.7.0, 4.7.1, 4.7.2, 4.7.3, 4.7.4, 4.8.0 Cloud only, 4.8.1 Cloud only, 4.9.0, 4.9.1, 4.9.2, 4.9.3, 4.9.4, 4.9.5, 4.9.6, 4.10.0 Cloud only, 4.10.1 Cloud only, 4.10.2 Cloud only, 4.10.3 Cloud only, 4.10.4 Cloud only, 4.11.0, 4.11.1, 4.11.2, 4.11.3, 4.11.4, 4.11.5, 4.12.0 Cloud only, 4.12.1 Cloud only, 4.13.0

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters