Splunk® IT Service Intelligence

Administration Manual

Splunk IT Service Intelligence (ITSI) version 4.12.x reached its End of Life on January 22, 2024. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see Before you upgrade IT Service Intelligence.
This documentation does not apply to the most recent version of Splunk® IT Service Intelligence. For documentation on the most recent version, go to the latest release.

Use the ITSI Health Check dashboard

The ITSI Health Check dashboard provides basic statistics about your ITSI environment.

Dashboard panels

Panel Description
Splunk Server Information Basic server information for each host.
ITSI Migration Status The current version of ITSI and the ITSI KV store. These versions should be the same.
ITSI Upgrade Readiness Checks whether any service templates are currently syncing. If so, it is not safe to upgrade. Click Configure > Service Templates to see the current sync status of your service templates.
Basic ITSI Information For each host, lists the number of services, searches, and entities, as well as KV store and HEC information.
KPI Base Search Usage Summary The number of KPIs using each base search.
KV Store Collections All ITSI KV store collections, the number of objects in each collection, acceleration information, and the collection size. If a collection is approaching the limit, consider trimming it to retain three months or less of metadata. For instructions, see Trim down notable event KV store collections in the Event Analytics manual.
Concurrent Searches All ITSI searches currently running.
Interesting Indexes All ITSI indexes and their statistics.
Interesting Searches Real-time searches that ITSI runs. itsi_event_grouping handles event grouping for notable event aggregation policies and is stored in savesearches.conf. itsi_mad_context and itsi_mad_cohesive_context handle metric anomaly detection and are stored in /SA-ITSI-MetricAD/local/savedsearches.conf once KPI anomaly detection is turned on. If any search jobs are failed or not running, this could indicate a problem.
KPI Performance Basic performance information for each KPI in your ITSI instance. Any failed or skipped searches indicate a problem. The runtime headroom percentage indicates how much time has been used up out of the search's frequency. A headroom percentage close to 100 is best, and a value closer to 0 indicates a problem.
Saved search Error Messages Lists names of saved search with error messages that include details about count, average run time, message key, and error messages.
Not Executed Searches (In last 1 hour) The number of searches that were not executed in the last hour.
Refresh Queue Runtimes Statistics for the refresh queue. The refresh queue ensures data integrity and eventual consistency of your ITSI configuration. It runs as a single instance.
Refresh Queue Failed Jobs The number of failed jobs in the refresh queue. Click a failed job to drill down to the logs.
ITSI Log Messages (deduplicated) Warning and error messages in the ITSI logs. The messages are deduplicated so you won't see the same error multiple times.
Check for Duplicate Entity Aliases Lists the entity aliases (field-value pairs) identifying more than one entity.
Last modified on 19 October, 2023
Troubleshoot ITSI backups and restores   Use the ITSI SVC Statistics dashboard

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.12.0 Cloud only, 4.12.1 Cloud only, 4.12.2 Cloud only, 4.13.0, 4.13.1, 4.13.2, 4.13.3, 4.14.0 Cloud only, 4.14.1 Cloud only, 4.14.2 Cloud only, 4.15.0, 4.15.1, 4.15.2, 4.15.3, 4.16.0 Cloud only, 4.17.0, 4.17.1


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters