Splunk® IT Service Intelligence

Service Insights Manual

Acrobat logo Download manual as PDF

This documentation does not apply to the most recent version of Splunk® IT Service Intelligence. Click here for the latest version.
Acrobat logo Download topic as PDF

Create a classic glass table in ITSI

This feature is deprecated.
The classic glass table framework is deprecated in IT Service Intelligence as of version 4.7.0. You can no longer create, edit, or clone glass tables in the classic framework. Although this framework continues to function, it might be removed in a future version. This classic framework has been superseded by an updated framework that offers more customization and ease of use. See Overview of the glass table editor in ITSI.

In the version 4.7.0 Release Notes, see Removed features in Splunk IT Service Intelligence.

Create a glass table to visualize and monitor the interrelationships and dependencies across your IT and business services. You can add metrics like KPIs, ad hoc searches, and service health scores that update in real time against a background that you design. Glass tables show real-time data generated by KPIs and services.

  1. From the ITSI main menu, click Glass Tables.
  2. Click Create Glass Table.
  3. (Optional) Type a Title and Description. Don't use any special characters in the title.
  4. Set Permissions to Private or Shared in App. If you select Shared in App, all Splunk roles have read and write permission by default. You can change this after you save the glass table. If you select Shared in App and service-level permissions are implemented, the ITSI roles assigned permission can only see the services and KPIs for which they have read permission.
  5. Click Create.
  6. (Optional) If the glass table is shared, assign read/write permissions to specific roles by clicking Edit > Edit Permissions under the Actions menu.

Configure KPI widgets

After you add a KPI widget to your glass table, configure it to optimize performance, add a custom drilldown, and change the viz type. You cannot modify KPI searches in the editor.

  1. In the glass table editor, click a KPI widget to expand the Configurations panel.
  2. For Use KPI Summary, click Yes to enable KPI summary indexing and accelerate search speeds. KPI summary indexing applies to KPIs only, not service health scores.
  3. (Optional) For Drilldown, click On, then select a drilldown destination or type a custom URL.

    When providing a custom URL, if you do not provide an http:// address, the generated URL is one that is internal to ITSI and located via a localhost URL, for example localhost:8000//. But when you provide an http:// prefix, (for example, http://splunk.com), the drilldown directs to that external URL.

  4. For Viz Type, select an appropriate option to display your KPI search results.
  5. Click Update to update the KPI configuration. The widget's appearance changes to the new viz type.
  6. Click Save.

Note: If you don't have permission to view a glass table widget, it displays as an empty gray box with a "Permission Denied" message. Read and write access to services and KPIs is controlled by teams. For information about teams, see Overview of teams in ITSI in the Administration Manual.

Configure ad hoc search widgets

You can also create a custom widget to display search results based on ad hoc searches. Add a new ad hoc search to any glass table, define a custom search string, and customize the appearance of the search widget using a variety of viz types. Your custom search must include the timechart command, or stats by _time to use thresholding.

  1. In the glass table editor, drag Ad hoc Search from the Services panel onto the canvas. A single-value widget appears.
  2. In the Configurations panel, under Search, enter your own custom search string.
  3. In the time range picker, select the end time for your ad hoc search.
  4. In the Earliest Time menu, select the earliest time for the ad hoc search. This determines the start time for your ad hoc search, relative to the End Date and Time that you set in the time range picker. It determines the time range over which your ad hoc search applies.
  5. For Threshold Field, enter the field on which to base thresholding for the ad hoc search. For example, count.
  6. (Optional) For Thresholds, click On to enable the display of thresholds for the ad hoc search widget.
    1. Click Edit to open the threshold window.
    2. Add thresholds for the ad hoc search. This determines the color of the widget, which indicates the current status of the metric.
  7. Select a Viz Type for your ad hoc search widget.
  8. Click Update to update the viz type and display your ad hoc search results over the specified time range.
  9. Click Save.

Use shapes and icons as glass table widgets

You can configure a shape or icon in your glass table to act like a KPI or ad hoc search widget. If you calculate the color based on a KPI, the color of the shape or icon changes based on the KPI severity level. If you calculate the color based on an ad hoc search, the color of the shape or icon changes based on the search results from the search string you specify.

  1. From the glass table tool bar, add a rectangle, ellipse, line, or icon.
  2. With the object selected, click Color Calculation in the Configurations panel and select Ad hoc Search or KPI.
    1. For an ad hoc search, enter your own custom search string in the Search box.
    2. For a KPI, select a service and a corresponding KPI. When the KPI severity level changes, the color of the shape or icon changes accordingly.

  3. When you're done configuring the widget, click Update to update the widget configuration.

Upload custom icons

ITSI lets you upload custom icons to design glass tables based on your organization's standards. Only .svg files are supported. You can create multiple icon categories to manage different families of icons. After you upload icons, they remain in the KV store so you can use them again.


  • You must have the itoa_admin or itoa_team_admin role to upload custom icons.


  1. In the glass table tool bar, click the Icon button.
  2. Click + New Category.
  3. Type a category name.
  4. Drop your files or click browse... to select them. You can upload multiple files at once.

    You can only upload SVG files.

  5. In the New Category window, click on individual icon names to rename them. You cannot have two icons with the same name.
  6. When you are satisfied with your icons and names, click Save. The new icon category appears with the others in the Select icon window.

After you create an icon category, you can add more icons to it by clicking the pencil icon beside the category name.

Last modified on 24 August, 2020
Tutorial: Build a glass table to monitor your infrastructure
Manage classic glass tables in ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.7.0, 4.7.1, 4.7.2, 4.7.3, 4.7.4, 4.8.0 Cloud only, 4.8.1 Cloud only, 4.9.0, 4.9.2, 4.9.3, 4.9.4, 4.9.5, 4.9.6

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters