Splunk® IT Service Intelligence

Service Insights Manual

Acrobat logo Download manual as PDF

This documentation does not apply to the most recent version of Splunk® IT Service Intelligence. Click here for the latest version.
Acrobat logo Download topic as PDF

Create custom threshold windows in ITSI

This feature is currently in beta.

Create custom KPI threshold windows to account for time periods when your KPI threshold values may vary due to seasonal events, like holidays, in order to avoid false alerts. After creating your custom threshold windows, your settings are automatically applied to the KPI severity evaluation when your custom threshold window is active. The adjustments are also applied to additional KPI configurations, such as adaptive thresholding, and linked KPI threshold templates and service templates. Any KPIs linked to a custom threshold window display an Active badge on the Service Analyzer and Service configuration pages.


Requirement Description
ITSI roles You must have the itoa_admin or itoa_team_admin role. For more information, see Configure users and roles in ITSI in the Administration Manual.
Create services and KPIs Create services with KPIs to link to your custom threshold windows. For more information, see Overview of creating services in ITSI and Overview of creating KPIs in ITSI.


Follow these steps to create a custom threshold window.

Step 1. Create a custom threshold window

  1. Select Configuration > Custom Threshold Windows from the ITSI main menu.
  2. Click Create Custom Threshold Window to create a new window.
  3. Configure the following fields for your custom threshold window:
    Field Description
    Title The name of the custom threshold window. Each custom threshold window must have a unique name.
    Description (Optional) Describe your custom threshold window.
    Schedule How often your custom threshold window runs. Select one of the following options:
    • Does not repeat
    • Run every week
    • Run every month
    Window start The approximate date, hour, and minute at which the custom threshold window begins to run.
    Window duration The number of days or hours to which the threshold window applies. Select up to 90 days or 2160 hours.
    Link at least one KPI to this custom Threshold Window Select at least one service and KPI to link to the custom threshold window. You can't create a custom threshold window without selecting at least one KPI or service.

    If the 'Link additional KPIs after creation checkbox is selected, you're redirected to the custom threshold window configuration page to add additional KPIs.

  4. Click Create. If the Select KPIs to link checkbox is selected, you're redirected to the custom threshold window configuration page to add additional settings. Otherwise, your custom threshold window is added to the list of custom threshold window policies on the previous page.

Read-only custom threshold windows

Your custom threshold window becomes read-only and can't be edited during the following conditions:

  • When the window status is Completed and the schedule is set to Does not repeat
  • When the window status is Active
  • When you do not have permissions to view or edit one or more of the KPIs linked to the custom threshold window

Step 2. Apply threshold configuration

On the configuration page for your custom threshold window, select a value that will increase or decrease the KPI threshold values by the specified percent value in the Threshold Configuration section. For example, if the range for a Low severity-level KPI threshold is set to 10-100, selecting "Increase by 10%" updates the range to map to alert values between 11-110.

You can preview the effect of your configuration settings on your KPIs in the Preview section, and view the effect of a threshold during a specific time range by selecting an option on the Time Range Window dropdown.

Step 3. Link additional KPIs

Click the Linked Services and KPIs button to add additional services and KPIs that you want to link to your custom threshold window. You can only edit a custom threshold window linked to KPIs for which you have read and write permissions.

Note: Permission to edit the custom threshold window is based on the permissions set for the KPIs that you link here.

  1. Click Link Services & KPIs.
  2. Select or search for the KPIs that you want to link to this threshold window in the popup modal. Your Custom window configuration will apply to these KPIs at the time your window becomes active.
  3. Click Save.

Note: When a KPI linked to a custom threshold window is updated elsewhere in ITSI, changes are automatically applied to the custom threshold window and any adjusted thresholds are re-evaluated.

Note: You can't link KPIs that are already linked to another custom threshold window with an overlapping scheduled time period.

Example custom threshold window use case

You want the ability to adjust the threshold configuration of your KPIs for large retail moments like Black Friday, because you notice a deviation in KPI values during this event, generating false alerts that are only the result of this seasonal spike in website visits. Although adaptive thresholds can help to account for changes in your annual business cycle, they don't account for seasonal changes outside of the 60 day business cycle (the maximum training period supported for adaptive thresholds is 60 days), such as changes caused by seasonal holiday activity.

Backup and Restore

Custom threshold windows are saved as part of a full backup of your ITSI environment.

When you restore an ITSI backup, the status (Active, Scheduled, Completed, Restoring, or Skipped) for your custom threshold windows is updated based on the time that your environment is restored. For example, if your recurring custom threshold window was active during a backup job, but the scheduled time for your custom threshold window to execute has passed, then the custom threshold window's status and any linked KPIs are updated to Scheduled. If the custom threshold window was configured to run only once, then the status is updated Completed after restoring the backup.

Note: The custom threshold window can have a Skipped status if it was restored but did not run.

Last modified on 17 October, 2022
Create adaptive KPI thresholds in ITSI
Overview of deep dives in ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.13.0, 4.13.2, 4.14.0 Cloud only, 4.14.1 Cloud only, 4.14.2 Cloud only

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters