Splunk® IT Service Intelligence

Modules

Download manual as PDF

Download topic as PDF

Web Server Module KPIs and thresholds

This topic provides detail on the Key Performance Indicators (KPIs) and the thresholds associated with those KPIs in the context of the Web Server Module. These KPIs impact the Health Score of the IT Service.

The default metric calculation type for the following KPIs is set to an average over the last minute. The default KPI calculation window for this module is Last 15 minutes, and calculation interval is Every 5 minutes. Adjust the search calculation interval for each supported add-on to match the five minute ITSI module calculation interval. The following KPIs have thresholds (normal, medium, and high) that are are predefined based on recommended best practices that can be updated by the users with analyst or admin privileges. See Role configuration in the Securing Splunk Enterprise manual.

Adjust the search calculation time for this module:

  1. Within ITSI, navigate to Configure, and select KPI Base Searches.
  2. Navigate to the KPI you wish to modify, and select Edit, followed by Clone.
  3. Name your cloned KPI base search and click Clone Page.
  4. Click on the KPI you wish to modify.
  5. Navigate to KPI Search Schedule, and select Every 5 Minutes from the dropdown menu.
  6. Click Save.

Web Server Module KPI Availability

The table below displays KPI availability based on use of the supported Web Server Module technologies.

If there is data in the ITSI swim lanes, the corresponding KPI field is checked (X), otherwise, it is empty.

KPI Name Splunk Add-on for Apache Web Server Splunk Add-on for Microsoft IIS
4xx Errors X X
5xx Errors X X
Availability X X
Bytes In X X
Bytes Out X X
Hits Per Minute X X
Percent Error Codes X X
Response Times X X

Web Server Module KPIs

KPIs to collect various web server transaction and performance metrics

KPI Name Description Unit Type Threshold Values
4XX Errors The count of 4xx response statuses Count Adaptive: 7 Days
5XX Errors The count of 5xx response statuses Count Adaptive: 7 Days
Bytes In Sum of bytes from requests to the server (search is run every 5 minutes) kB Adaptive: 7 Days
Bytes Out Sum of bytes sent out from the server (search is run every 5 minutes) kB Adaptive: 7 Days
Hits Per Minute Number of requests handled per minute by the web server RPS (requests per second) Adaptive: 7 Days
Percent Error Codes The percentage of total responses that resulted in a 4xx or 5xx error code Percentage High: 10 Medium: 5-10 Normal: 0-5
Response Times The average response time for all requests ms Adaptive: 7 Days
WebServer Availability Percent of successful transactions out of total transactions Binary None
Last modified on 18 March, 2020
PREVIOUS
Web Server Module configurations
  NEXT
Web Server Module data model reference table

This documentation applies to the following versions of Splunk® IT Service Intelligence: 3.0.0, 3.0.1, 3.0.2, 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.1.0, 4.1.1, 4.1.2, 4.1.5, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1, 4.4.0, 4.4.1, 4.4.2, 4.4.3


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters