Splunk® IT Service Intelligence

User Manual

Acrobat logo Download manual as PDF

Splunk IT Service Intelligence version 4.4.x will no longer be supported as of October 22, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see Before you upgrade IT Service Intelligence.
This documentation does not apply to the most recent version of Splunk® IT Service Intelligence. Click here for the latest version.
Acrobat logo Download topic as PDF

Create a glass table in ITSI

In the next major ITSI release, you will no longer be able to create or clone glass tables in the classic framework. You will still be able to edit existing classic glass tables. All classic glass tables in your environment will be cloned to the beta framework. The beta framework will soon become the official and only framework, so it is recommended that you begin to use this new framework exclusively. For more information, see Overview of the beta glass table editor in ITSI.

Create a glass table to visualize and monitor the interrelationships and dependencies across your IT and business services. You can add metrics like KPIs, ad hoc searches, and service health scores that update in real time against a background that you design. Glass tables show real-time data generated by KPIs and services.

  1. In the main menu, click Glass Tables.
  2. Click Create Glass Table.
  3. (Optional) Type a Title and Description. Don't use any special characters in the title.
  4. Set Permissions to Private or Shared in App. If you select Shared in App, all Splunk roles have read and write permission by default. You can change this after you save the glass table. If you select Shared in App and service-level permissions are implemented, the ITSI roles assigned permission can only see the services and KPIs for which they have read permission.
  5. Click Create.
  6. (Optional) If the glass table is shared, assign read/write permissions to specific roles by clicking Edit > Edit Permissions under the Actions menu.

Configure KPI widgets

After you add a KPI widget to your glass table, configure it to optimize performance, add a custom drilldown, and change the viz type. You cannot modify KPI searches in the editor.

  1. In the glass table editor, click a KPI widget to expand the Configurations panel.
  2. For Use KPI Summary, click Yes to enable KPI summary indexing and accelerate search speeds. KPI summary indexing applies to KPIs only, not service health scores.
  3. (Optional) For Drilldown, click On, then select a drilldown destination or type a custom URL.

    If you don't provide an http:// address, the generated URL is internal to ITSI and located via a localhost URL, for example localhost:8000//.

  4. For Viz Type, select an appropriate option to display your KPI search results.
  5. Click Update to update the KPI configuration. The widget's appearance changes to the new viz type.
  6. Click Save.

Note: If you don't have permission to view a glass table widget, it displays as an empty gray box with a "Permission Denied" message. Read and write access to services and KPIs is controlled by teams. For information about teams, see Overview of teams in ITSI in the Install and Upgrade IT Service Intelligence manual.

Configure ad hoc search widgets

You can also create a custom widget to display search results based on ad hoc searches. Add a new ad hoc search to any glass table, define a custom search string, and customize the appearance of the search widget using a variety of viz types. Your custom search must include the timechart command, or stats by _time to use thresholding.

  1. In the glass table editor, drag Ad hoc Search from the Services panel onto the canvas. A single-value widget appears.
  2. In the Configurations panel, under Search, enter your own custom search string.
  3. In the time range picker, select the end time for your ad hoc search.
  4. In the Earliest Time menu, select the earliest time for the ad hoc search. This determines the start time for your ad hoc search, relative to the End Date and Time that you set in the time range picker. It determines the time range over which your ad hoc search applies.
  5. For Threshold Field, enter the field on which to base thresholding for the ad hoc search. For example, count.
  6. (Optional) For Thresholds, click On to enable the display of thresholds for the ad hoc search widget.
    1. Click Edit to open the threshold window.
    2. Add thresholds for the ad hoc search. This determines the color of the widget, which indicates the current status of the metric.
  7. Select a Viz Type for your ad hoc search widget.
  8. Click Update to update the viz type and display your ad hoc search results over the specified time range.
  9. Click Save.

Use shapes and icons as glass table widgets

You can configure a shape or icon in your glass table to act like a KPI or ad hoc search widget. If you calculate the color based on a KPI, the color of the shape or icon changes based on the KPI severity level. If you calculate the color based on an ad hoc search, the color of the shape or icon changes based on the search results from the search string you specify.

  1. From the glass table tool bar, add a rectangle, ellipse, line, or icon.
  2. With the object selected, click Color Calculation in the Configurations panel and select Ad hoc Search or KPI.
    1. For an ad hoc search, enter your own custom search string in the Search box.
    2. For a KPI, select a service and a corresponding KPI. When the KPI severity level changes, the color of the shape or icon changes accordingly.

  3. When you're done configuring the widget, click Update to update it.

Upload custom icons

ITSI lets you upload custom icons to design glass tables based on your organization's standards. Only .svg files are supported. You can create multiple icon categories to manage different families of icons. After you upload icons, they remain in the KV store so you can use them again.


  • You must have the itoa_admin or itoa_team_admin role to upload custom icons.


  1. In the glass table tool bar, click the Icon button.
  2. Click + New Category.
  3. Type a category name.
  4. Drop your files or click browse... to select them. You can upload multiple files at once.

    You can only upload SVG files.

  5. In the New Category window, click on individual icon names to rename them. You cannot have two icons with the same name.
  6. When you are satisfied with your icons and names, click Save. The new icon category appears with the others in the Select icon window.

After you create an icon category, you can add more icons to it by clicking the pencil icon beside the category name.

Last modified on 15 April, 2020
Take action on an episode in ITSI
Manage glass tables in ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters