Splunk® IT Service Intelligence

Use Splunk IT Service Intelligence

Download manual as PDF

Download topic as PDF

Investigate a service with poor health in ITSI

The Service Analyzer displays information about underlying entities and critical and high episodes associated with services. This helps you more quickly investigate the cause of service degradation.

To investigate a service with poor health or a service that displays a notification icon, click the service tile. A panel opens displaying the severity and values of the KPIs associated with the service and up to 20 episodes associated with the service that have a severity of critical or high. Furthermore, you can click on a KPI in the side panel (or on a KPI tile) to see a secondary panel that shows the severity and value of any entities that contribute to the KPI.

If you bookmark or copy the URL for a service analyzer page, the service or KPI that is selected and any side panels that are open are saved as part of the page.

Scenario

You are an IT Operations analyst monitoring service health on the ITSI Service Analyzer.

  1. You notice a notification icon on the Database Service tile. You hover over the icon and see a message that the service has entities in a degraded state and also has critical or high episodes associated with it.
    Notif Icon.png

  2. You click the Database tile and a side panel opens showing the service KPIs and the critical or high episodes.
    SASidePanel.png
    You see that one KPI has a notification icon indicating that it has entities in a degraded state. You also see there is one episode in a critical state containing over a hundred events.

    Tip: Click View All to view the groups in Episode Review. Episode Review opens in a new tab and is filtered for the service you are viewing and the time range you are using on the Service Analyzer page. For information about Episode Review, see Overview of Episode Review in ITSI.

  3. You click the Storage Free Space KPI with the notification icon. A secondary panel opens showing the contributing entities for this KPI.
    ContribEntities.png
    You can now observe that the mysql-02 entity is in a critical state and has no free space. You have discovered the root cause of the service degradation.

  4. You click the name of the entity to see more information about the host on the Entity Details page. From here, you can see entity details such as title, host, application, itsi_role, version, and family.

    You can only edit an entity on the Entity Details page if you have write permissions to the Global team. By default only the itoa_admin role has write permissions to the Global team.

PREVIOUS
Aggregate versus maximum severity KPI values in ITSI
  NEXT
Overview of Episode Review in ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.1.0, 4.1.1, 4.1.2, 4.1.5, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters