Add a predictive model to a glass table in ITSI

You can add predictive models to glass tables as ad hoc search visualizations. This lets you actively monitor service health and troubleshoot imminent issues before they impact your services.

Ad hoc searches are not optimized because each visualization runs its own individual search. Thus, the loading time for your glass table visualization is proportional to the number of predictive model visualizations you add.

Prerequisite

• You must have a trained model saved into the service definition. For more information, see Train a predictive model in ITSI.
• Select Configuration > Services, and select a service. Make sure you're on the Predictive Analytics tab within the service.

Steps

1. Within the service, click on the Predictive Analytics tab and select the model under Test a Model.
2. Click the magnifying glass in the Predicted Average Case Service Health Score or Predicted Worst Case Service Health Score panel to open the predictions in the Search app.

   The search is the same whether you select average or worst case.

3. Copy the search string.
4. Open your glass table in Edit mode.
5. Select the data icon and click Create Ad hoc search.
6. Paste the copied search string into the Search with SPL box. Click Run & Save.
7. Select the ad hoc search you created to add it to the glass table. This will add a new ad-hoc visualization to the glass table.

Note:By default, the global time range picker sets the time range for all visualizations. Alternatively, you can add additional inputs to set custom time ranges on a per-visualization basis. See [http://docs.splunk.com/Documentation/ITSI/4.19.1/SI/Visualizations#Set_different_time_ranges_for_visualizations Set different time ranges for visualizations].

8. After adding the ad-hoc visualization, click Source to access the source editor. Update the trend section under encoding, and update the primary[0] input to your desired threshold setting. Type primary.next30m_avg_hs to display the average prediction, or primary.next30m_worst_hs to display the worst case prediction.
9. (Optional) Add color thresholding to predictive analytics visualizations:
   1. (Optional) Select a data field to pull search values from by clicking the Selected Data Field dropdown menu. By default, the first numeric data field is selected.
   2. Apply dynamic color thresholds using the Coloring section in the Configuration panel. For more information, see Configuration options for single value and single value icon visualizations.
10. (Optional) Add a drilldown to the Predictive Analytics dashboard:
    2. Select the visualization.
    3. In the Configuration panel, select Add Drilldown.
    4. For On Click, choose the Link to custom URL option.
    5. In a separate ITSI window, navigate to Dashboards > Predictive Analytics.
    6. Select the service and corresponding model to display the health score prediction.
    7. Copy the URL and paste it into the URL field in the Configuration panel.
    8. Edit the URL from auto_load=false to auto_load=true to automatically load all of the dashboard panels.
11. Select a visualization type in the Configuration panel. You cannot use the sparkline or trending value visualization types because the prediction is a static value.
12. Click Save.

For more information about ad hoc search visualizations, see Add an ad hoc search visualization.