Splunk® IT Service Intelligence

User Manual

Acrobat logo Download manual as PDF

This documentation does not apply to the most recent version of ITSI. Click here for the latest version.
Acrobat logo Download topic as PDF

Configure KPI lanes in a deep dive in ITSI

KPI lanes in IT Service Intelligence (ITSI) deep dives display search results for existing KPIs in your services. KPI lanes also provide the option of running searches against the KPI summary index, which can accelerate search times.


  • You must have the write_itsi_deep_dive capability to add a swim lane to a deep dive. By default, the itoa_admin, itoa_team_admin, and itoa_analyst roles are assigned this capability.
  • Read and write access to services and KPIs is controlled by team permissions. When adding a new swim lane, you can only select from services to which you have read access. You cannot perform bulk actions on lanes for which you do not have read access.

Create a KPI lane

  1. In the deep dive, select Add Lane > Add KPI Lane.
  2. Configure your new KPI lane.
    Field Description
    Title The title for your new KPI lane.
    Subtitle (optional) Additional info about your search, service, and so on.
    Graph Type Line, Area, or Column. For count-based KPIs, choose Column to display discreet numeric values without interpolation.
    Graph Color The color for your KPI lane graph.
    Lane Size Adjust the lane height for easier viewing and analysis.
    Service The service containing the KPI you want to display.
    KPI The specific KPI you want to display.
    Accelerate Using KPI Summary By default, all KPI searches are run against the itsi_summary index, which increases search speeds. Select No if you want to switch from itsi_summary index search to raw search. This option is disabled for KPI searches with calculation windows of 24 hour or more.
  3. Click Create Lane. Your new KPI lane appears in the deep dive.

Configure threshold options for a KPI lane

You can display KPI status as either a graph against horizontal color bands that represent threshold severity levels, or as discreet vertical color blocks that represent the severity level over a given unit of time. Threshold view options apply to KPI lanes only.

The following example shows the difference between level and state indication:



  1. Click the gear icon DDgear.png in the KPI lane and select Threshold Options.
  2. Set Enable Threshold Indication to Yes.
  3. Choose a threshold indication type:
    Field Description
    Level Indication Displays thresholds as horizontal bands.
    State Indication Displays thresholds in distinct time blocks.

    State indication shows the aggregate KPI status for KPIs that are split by entity.

  4. (Optional) If you chose state indication, enable Hide Graph to show severity-level thresholds in distinct time blocks without the line graph.
  5. Click Done.

After you configure your threshold options, you can use the Bulk Actions menu to show or hide thresholds for selected lanes.

Configure graph rendering options for a KPI lane

Graph rendering options determine how a KPI's results are displayed in a swimlane. While the rendering options are set to reasonable defaults, you can alter them depending on the type of data you're analyzing.

To access the graph rendering options for a KPI lane:

  1. Click the gear icon DDgear.png in the KPI lane and select Graph Rendering Options.
  2. Configure the following options:

Vertical Axis Scale

The vertical axis scale determines the scale of the y-axis of your KPI swimlane. On a linear scale the value between any two data points never change. A logarithm is based on exponents, so on a logarithmic scale the value between two points changes in a particular pattern.

Option Description
Linear The scale for deep dive swim lanes. Use linear scale if your data stays within a relatively reasonable boundary of values.
Logarithmic Useful for datasets with very high numbers and very low numbers. If you want to see the behavior of the low numbers without them being overshadowed by the high numbers, use a logarithmic scale.

Vertical Axis Boundary

The vertical axis scale determines the starting and ending boundaries of the Y-axis of a KPI lane. Because deep dives are meant to compare the behavior of many metric time series to each other, the default is Data Extent.

Option Description
Data Extent Data Extent means that the lowest value in your data will be the lowest value of the Y-axis and the highest value of your data will be the highest value of the Y-axis. For example, if the highest value in your data set is 23 and the highest is 50, the Y-axis will span from 23 to 50.

Data Extent helps you more easily visually correlate behavioral trends in data. For example, if a KPI is measuring requests per second, and you have millions of requests per second, the trend line would remain visually flat if the axis boundary started at zero. By using Data Extent, the Y-axis is essentially "zoomed in" to focus on the interesting part of the graph - the extent of the data.

Zero Extent Zero Extent is the same as Data Extent except it includes a minimum value of zero. For example, even if your data ranges from 23 to 50, the Y-axis boundary will be from zero to 50. Similarly, if your data ranges from -50 to -27, the Y-axis will range from -50 to zero. Zero extent is useful for datasets that don't have a lot of large numbers or variability.
Static Configure your own Y-axis boundaries depending on your use case. For example, if your KPI value is a percentage, change the vertical axis boundary to a minimum value of 0 and a maximum value of 100.

Graph Data Gaps

This setting determines how the deep dive displays gaps in your data. It's important to note that a "gap" doesn't necessarily mean data was missed.

When set to Connected, the deep dive essentially interpolates the data between the actual KPI data points collected at regular intervals. For example, your KPI search might be configured to run every five minutes, but deep dives by default display data for every few seconds. ITSI essentially draws a line between those two data points to connect them and fill in the "missed" five minutes. The following image shows a lane with connected data gaps:


When set to Gaps, the deep dive removes this interpolation and instead fills data gaps with gray boxes. For count-based KPIs, you can use this setting to see the discreet data points corresponding to the counts coming in. The following image shows a lane displaying data gaps:


Last modified on 12 January, 2021
Configure metric lanes in a deep dive in ITSI
Configure event lanes in a deep dive in ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.5.0 Cloud only, 4.5.1 Cloud only, 4.6.0 Cloud only, 4.6.1 Cloud only, 4.6.2 Cloud only, 4.7.0, 4.7.1, 4.7.2, 4.7.3, 4.7.4

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters