Splunk® IT Service Intelligence

Administration Manual

Use the ITSI Health Check dashboard

The ITSI Health Check dashboard provides basic statistics about your ITSI environment.

In release 4.19.0, this dashboard was converted from SXML to UDF. SXML versions of this dashboard are no longer being updated.

Dashboard panels

Panel Description
Splunk Server Information Basic server information for each host.
ITSI Migration Status The current version of ITSI and the ITSI KV store. These versions should be the same.
ITSI Upgrade Readiness Checks whether any service templates are currently syncing. If so, it is not safe to upgrade. Click Configure > Service Templates to see the current sync status of your service templates.
Basic ITSI Information For each host, lists the number of services, searches, and entities, as well as KV store and HEC information. Also lists maximum number of objects in each collection.
KV Store Collections All ITSI KV store collections, the number of objects in each collection, acceleration information, and the collection size. If a collection is approaching the limit, consider trimming it to retain three months or less of metadata. For instructions, see Trim down notable event KV store collections in the Event Analytics manual.
KPI Performance Basic performance information for each KPI in your ITSI instance. Any failed or skipped searches indicate a problem. The runtime headroom percentage indicates how much time has been used up out of the search's frequency. A headroom percentage close to 100 is best, and a value closer to 0 indicates a problem. Select a base search to view and configure its settings.
Entity Count by Shared Base Search View and configure KPI base searches.
KPI Base Search Usage Summary The number of KPIs using each base search.
Interesting Searches Real-time searches that ITSI runs. itsi_event_grouping handles event grouping for notable event aggregation policies and is stored in savesearches.conf. itsi_mad_context and itsi_mad_cohesive_context handle metric anomaly detection and are stored in /SA-ITSI-MetricAD/local/savedsearches.conf once KPI anomaly detection is turned on. If any search jobs are failed or not running, this could indicate a problem.
Refresh Queue Failed Jobs The number of failed jobs in the refresh queue. Click a failed job to drill down to the logs.
Refresh Queue Runtimes Statistics for the refresh queue. The refresh queue ensures data integrity and eventual consistency of your ITSI configuration. It runs as a single instance.
Recent Refresh Queue Jobs List of refresh queue jobs.
Average CPU utilization per host Line chart of CPU utilization that you can correlate against recent refresh queue or search jobs.
Average CPU utilization by process (%) Bar chart of CPU utilization that you can correlate against recent refresh queue or search jobs.
Average Memory Utilization by Process (MB) Chart of memory usage by specific processes.
Concurrent Searches All ITSI searches currently running.
Saved search Error Messages Lists names of saved search with error messages that include details about count, average run time, message key, and error messages.
Not Executed Searches (In last 1 hour) The number of searches that were not executed in the last hour.
ITSI Log Messages (deduplicated) Warning and error messages in the ITSI logs. The messages are deduplicated so you won't see the same error multiple times.
Check for Duplicate Entity Aliases Lists the entity aliases (field-value pairs) identifying more than one entity. See Resolve conflicts during ITSI entity imports.
ITSI role/capability modifications Last role or modification changes made in the last 24 hours. Click the search to change the time range.

The time range picker in the ITSI Health Check dashboard does not support real-time search because many commands present in the dashboard search query do not support real-time search.

Last modified on 13 June, 2024
Troubleshoot ITSI backups and restores   Use the ITSI SVC Statistics dashboard

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.19.0

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters