Splunk® IT Service Intelligence

User Manual

Acrobat logo Download manual as PDF

Splunk IT Service Intelligence version 4.3.x will no longer be supported as of July 17, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see Before you upgrade IT Service Intelligence.
This documentation does not apply to the most recent version of Splunk® IT Service Intelligence. Click here for the latest version.
Acrobat logo Download topic as PDF

Create a glass table in ITSI

Create a glass table to visualize and monitor the interrelationships and dependencies across your IT and business services. You can add metrics like KPIs, ad hoc searches, and service health scores that update in real time against a background that you design. Glass tables show real-time data generated by KPIs and services.

  1. In the main menu, click Glass Tables.
  2. Click Create Glass Table.
  3. (Optional) Type a Title and Description.
  4. Set Permissions to Private or Shared in App. If you select Shared in App, all Splunk roles have read and write permission by default. You can change this after you save the glass table. If you select Shared in App and service-level permissions are implemented, the ITSI roles assigned permission can only see the services and KPIs for which they have read permission.
  5. Click Create.
  6. (Optional) If the glass table is shared, assign read/write permissions to specific roles by clicking Edit > Edit Permissions under the Actions menu.

Build a glass table visualization

Build a basic glass table using a flexible canvas and editing tools.

  1. Open a glass table from the Glass Tables lister page.
  2. Use the editing tools to change the background color, add images (supported image types are PNG, JPG/JPEG, and GIF), draw shapes, add icons and text, and make connections that reflect the relationship between glass table elements.
  3. In the Services panel, click any service to view all KPIs contained in that service. Only services you have permission to read are listed in the Services panel.
  4. Click and drag one or more KPIs onto the drawing canvas.
    A widget appears on the canvas, displaying the associated search values, which continuously update in real-time.
  5. Add additional KPIs, health scores, and ad hoc searches to build out the dynamic elements of your visualization. By default, KPI and ad hoc searches are represented by single-value widgets. Service health scores are represented by sparkline widgets.
  6. Click Save.

KPI search values update at regular intervals according to the search schedule that you define when you create the search.

Configure KPI widgets

After you add a KPI widget to your glass table, configure it to optimize performance, add a custom drilldown, and change the viz type. You cannot modify KPI searches in the editor.

  1. In the glass table editor, click a KPI widget to expand the Configurations panel.
  2. For Use KPI Summary, click Yes to enable KPI summary indexing and accelerate search speeds. KPI summary indexing applies to KPIs only, not service health scores.
  3. (Optional) For Drilldown, click On, then select a drilldown destination or type a custom URL.

    When providing a custom URL, if you do not provide an http:// address, the generated URL is one that is internal to ITSI and located via a localhost URL, for example localhost:8000//. But when you provide an http:// prefix, (for example, http://splunk.com), the drilldown directs to that external URL.

  4. For Viz Type, select an appropriate option to display your KPI search results.
  5. Click Update to update the KPI configuration. The widget's appearance changes to the new viz type.
  6. Click Save.

Note: If you do not have permission to view a glass table widget, it displays as an empty gray box with a "Permission Denied" message. Read and write access to services and KPIs is controlled by service-level permissions. For information about service-level permissions, see Overview of teams in ITSI in the Install and Upgrade IT Service Intelligence manual.

Configure ad hoc search widgets

You can also create a custom widget to display search results based on ad hoc searches. Add a new ad hoc search to any glass table, define a custom search string, and customize the appearance of the search widget using a variety of viz types. Your custom search must include the timechart command, or stats by _time to use thresholding.

  1. In the glass table editor, drag Ad hoc Search from the Services panel onto the canvas. A single-value widget appears.
  2. In the Configurations panel, under Search, enter your own custom search string.
  3. In the time range picker, select the end time for your ad hoc search.
  4. In the Earliest Time menu, select the earliest time for the ad hoc search. This determines the start time for your ad hoc search, relative to the End Date and Time that you set in the time range picker. It determines the time range over which your ad hoc search applies.
  5. For Threshold Field, enter the field on which to base thresholding for the ad hoc search. For example, count.
  6. (Optional) For Thresholds, click On to enable the display of thresholds for the ad hoc search widget.
    1. Click Edit to open the threshold window.
    2. Add thresholds for the ad hoc search. This determines the color of the widget, which indicates the current status of the metric.
  7. Select a Viz Type for your ad hoc search widget.
  8. Click Update to update the viz type and display your ad hoc search results over the specified time range.
  9. Click Save.

Use shapes and icons as glass table widgets

You can configure a shape or icon in your glass table to act like a KPI or ad hoc search widget. The color of the shape or icon changes based on the KPI or ad hoc search severity level.

  1. From the glass table tool bar, add a rectangle, ellipse, line, or icon.
  2. With the object selected, click Color Calculation in the Configurations panel and select Ad hoc Search or KPI.
    1. For an ad hoc search, enter your own custom search string in the Search box.
    2. For a KPI, select a service and a corresponding KPI. When the KPI severity level changes, the color of the shape or icon changes accordingly.
  3. When you're done configuring the widget, click Update to update the widget configuration.

Upload custom icons

ITSI lets you upload custom icons to design glass tables based on your organization's standards. Only .svg files are supported. You can create multiple icon categories to manage different families of icons. After you upload icons, they remain in the KV store so you can use them again.


  • You must have the itoa_admin or itoa_team_admin role to upload custom icons.


  1. In the glass table tool bar, click the Icon button.
  2. Click + New Category.
  3. Type a category name.
  4. Drop your files or click browse... to select them. You can upload multiple files at once.

    You can only upload SVG files.

  5. In the New Category window, click on individual icon names to rename them. You cannot have two icons with the same name.
  6. When you are satisfied with your icons and names, click Save. The new icon category appears with the others in the Select icon window.

After you create an icon category, you can add more icons to it by clicking the pencil icon beside the category name.

Last modified on 21 October, 2019
Take action on an episode in ITSI
Manage glass tables in ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters