Splunk® IT Service Intelligence


This documentation does not apply to the most recent version of Splunk® IT Service Intelligence. For documentation on the most recent version, go to the latest release.

Web Server Module KPIs and thresholds

This topic provides detail on the Key Performance Indicators (KPIs) and the thresholds associated with those KPIs in the context of the Web Server Module. These KPIs impact the Health Score of the IT Service.

The default metric calculation type for the following KPIs is set to an average over the last minute. The default KPI calculation window for this module is Last 15 minutes, and calculation interval is Every 5 minutes. Adjust the search calculation interval for each supported add-on to match the five minute ITSI module calculation interval. The following KPIs have thresholds (normal, medium, and high) that are are predefined based on recommended best practices that can be updated by the users with analyst or admin privileges. See Role configuration in the Securing Splunk Enterprise manual.

Adjust the search calculation time for this module:

  1. From the ITSI main menu, click Configuration > KPI Base Searches.
  2. Locate the KPI you want to modify and click Edit > Clone.
  3. Name your cloned KPI base search and click Clone Page.
  4. Click on the KPI you want to modify.
  5. Navigate to KPI Search Schedule, and select Every 5 Minutes from the dropdown menu.
  6. Click Save.

Web Server Module KPI Availability

The table below displays KPI availability based on use of the supported Web Server Module technologies.

If there is data in the ITSI swim lanes, the corresponding KPI field is checked (X), otherwise, it is empty.

KPI Name Splunk Add-on for Apache Web Server Splunk Add-on for Microsoft IIS
4xx Errors X X
5xx Errors X X
Availability X X
Bytes In X X
Bytes Out X X
Hits Per Minute X X
Percent Error Codes X X
Response Times X X

Web Server Module KPIs

KPIs to collect various web server transaction and performance metrics

KPI Name Description Unit Type Threshold Values
4XX Errors The count of 4xx response statuses Count Adaptive: 7 Days
5XX Errors The count of 5xx response statuses Count Adaptive: 7 Days
Bytes In Sum of bytes from requests to the server (search is run every 5 minutes) kB Adaptive: 7 Days
Bytes Out Sum of bytes sent out from the server (search is run every 5 minutes) kB Adaptive: 7 Days
Hits Per Minute Number of requests handled per minute by the web server RPS (requests per second) Adaptive: 7 Days
Percent Error Codes The percentage of total responses that resulted in a 4xx or 5xx error code Percentage High: 10 Medium: 5-10 Normal: 0-5
Response Times The average response time for all requests ms Adaptive: 7 Days
WebServer Availability Percent of successful transactions out of total transactions Binary None
Last modified on 28 April, 2023
Web Server Module configurations   Web Server Module data model reference table

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.11.0, 4.11.1, 4.11.2, 4.11.3, 4.11.4, 4.11.5, 4.11.6, 4.12.0 Cloud only, 4.12.1 Cloud only, 4.12.2 Cloud only, 4.13.0, 4.13.1, 4.13.2, 4.13.3, 4.14.0 Cloud only, 4.14.1 Cloud only, 4.14.2 Cloud only, 4.15.0, 4.15.1, 4.15.2, 4.15.3, 4.16.0 Cloud only, 4.17.0, 4.17.1, 4.18.0, 4.18.1

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters