Splunk® IT Service Intelligence

Service Insights Manual

Acrobat logo Download manual as PDF

Splunk IT Service Intelligence version 4.5.x will no longer be supported as of April 29, 2022. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see Before you upgrade IT Service Intelligence.
This documentation does not apply to the most recent version of Splunk® IT Service Intelligence. Click here for the latest version.
Acrobat logo Download topic as PDF

Add a predictive model to a glass table in ITSI

You can add predictive models to glass tables as ad hoc search widgets. This lets you actively monitor service health and troubleshoot imminent issues before they impact your services.

Ad hoc searches are not optimized because each widget runs its own individual search. Thus, the loading time for your glass table visualization is proportional to the number of predictive model widgets you add.


  • You must have a trained model saved into the service definition. For more information, see Train a predictive model in ITSI.
  • Make sure you're on the Predictive Analytics tab within the service.


  1. On the Predictive Analytics tab, select the model under Test a Model.
  2. Click the magnifying glass in the Predicted Average Case Service Health Score or Predicted Worst Case Service Health Score panel to open the predictions in the Search app.

    The search is the same whether you select average or worst case.

  3. Copy the search string.
  4. Open your glass table in Edit mode.
  5. Drag Ad hoc Search from the Services panel onto the canvas.
  6. In the Configurations panel, paste the search string into the Search box.
  7. In the time range picker, select the end time for your ad hoc search.
  8. Expand Earliest Time and select the start time for your ad hoc search relative to the end time in the time range picker. This determines the time range over which the ad hoc search applies.
  9. In Threshold Field, type next30m_avg_hs to display the average prediction, or next30m_min_hs to display the worst-case prediction.
  10. Enable Thresholds to display thresholds for the ad hoc search widget:
    1. For Thresholds, click On.
    2. Click Edit and configure the thresholds for the service health score prediction.
    3. When finished, click Done.
  11. (Optional) Add a drilldown to the Predictive Analytics dashboard.
    1. For Drilldown, click On.
    2. Click Default, and select Custom URL.
    3. In a separate ITSI window, navigate to Dashboards > Predictive Analytics.
    4. Select the service and corresponding model to display the health score prediction.
    5. Copy the URL and paste it into the URL field in the glass table.
    6. Edit the URL from auto_load=false to auto_load=true to automatically load all of the dashboard panels.
  12. Select a viz type for your ad hoc search widget. You cannot use the sparkline or trending value viz types because the prediction is a static value.
  13. Click Update to update the widget to the new visualization and display your search results over the specified time range.
  14. Click Save.

For more information, see Configure ad hoc search widgets.

Last modified on 22 October, 2020
Create an alert for potential service degradation in ITSI
Retrain a predictive model in ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.5.0 Cloud only, 4.5.1 Cloud only, 4.6.0 Cloud only, 4.6.1 Cloud only, 4.6.2 Cloud only

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters