Define a KPI source search in ITSI

When you create a KPI in IT Service Intelligence (ITSI), you must define a source search on which to build the KPI. You can chose from four source search types: data model, ad hoc search, metrics search, or base search.

Note: Before you define your source search, consider the performance implications for your particular deployment. While data models are suitable for smaller test environments, base searches generally provide best performance in larger production settings. See Create KPI base searches in ITSI.

For an overview of the entire KPI creation workflow, see Overview of creating KPIs in ITSI.

Prerequisites

• You must create a service before you can add KPIs to it. For instructions, see Overview of creating services in ITSI.
• To design a KPI search, you need to know the following information:
  • The source search expression, including selection criteria.
  • The specific field in the data that you want to monitor.
  • The time span and frequency for the KPI to update.
  • How to summarize the data over the time span (count, last, sum, average, and so on).
  • Whether you want to split the KPI result values by entities (for example, by host).

Define a source search from a data model

Configure the following fields:

Field	Description
KPI Source	Data Model
Data Model	The data model object, child, and attribute fields. For example, Host Operating System > Memory > mem_used_percent. When you create a KPI search from a data model, the data model object field becomes the threshold field. When you create a KPI search from an ad hoc search, you must manually enter the threshold field.
Filters (optional)	Click Add Filter to add data model filter conditions. Data model filters let you include/exclude search result data based on the filter conditions. For example, the filter condition host Equals ipaddress filters out all values for the data model search field host, except for values that equal ipaddress. Data model filtering can help improve the speed and accuracy of your searches by excluding extraneous data from search results.

Click Generated Search to preview your KPI search string. Use the search box to view changes ITSI makes to your search string as you build your KPI. Click anywhere on the generated search itself to run the search:

Define a source search from a metrics search

Configure the following fields:

Field	Description
KPI Source	Metrics Search If there are no metrics indexes configured in your Splunk deployment, you'll see the message "No metrics found". For more information about metrics, see Get started with Metrics in the Splunk Enterprise Metrics Manual.
Metrics Index	Select the metrics index from which to choose a metric. The list only populates with indexes defined locally on the search head you are accessing. To use an index defined only on an indexer, enter it manually.
Metric Name	Select the metric to use for the KPI. For example, memory.used.

Click Generated Search to preview your KPI search string. Metrics searches begin with the mstats command.

Define a source search from an ad hoc search

Configure the following fields:

Field	Description
KPI Source	Ad hoc Search
Search	The ad hoc search string that you create. This is the event gathering search for the KPI. Note: The use of transforming commands, the mstats command, the `gettime` macro, or time modifiers in your KPI search is not recommended as this may cause issues with KPI backfill, the display of raw data on ITSI views such as glass tables and deep dives that allow you to run KPI searches against raw data, and the KPI threshold preview.
Threshold Field	The field in your data that the KPI aggregates and monitors. For pure counts use _time.

Click Generated Search to preview your KPI search string.

Define a source search from a base search

Configure the following fields:

Field	Description
KPI Source	Base Search
Base Search	The base search that you want to associate with the KPI. For example, DA-ITSI-OS:Performance.Memory. Base searches provide preconfigured KPI templates built on ITSI modules.
Metric	The metric that you want to associate with the KPI. For example, mem_free_percent.

Click Generated Search to preview your KPI search string.

Most fields in the next new steps of the KPI creation workflow are pre-populated by the KPI template.

Next steps

After you define your source search, move on to step 2: Split and filter entities for a KPI in ITSI.