admingit
/
Deploiement_Server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '5f23f3f2cf'
${ noResults }
Deploiement_Server/deployment-apps/DA-ITSI-CP-monitoring-alerting/itsi/services/da-itsi-cp-monitoring-alert...

1095 lines
96 KiB
Raw Blame History

{
"algorithms": {
"GradientBoostingRegressor": {
"RMSE": 0,
"modelId": "",
"rSquared": 0,
"recommended": false
},
"LinearRegression": {
"RMSE": 0,
"modelId": "",
"rSquared": 0,
"recommended": false
},
"LogisticRegression": {
"accuracy": 0,
"f1_score": 0,
"modelId": "",
"precision": 0,
"recall": 0,
"recommended": false
},
"RandomForestRegressor": {
"RMSE": 0,
"modelId": "",
"rSquared": 0,
"recommended": false
}
},
"description": "",
"enabled": true,
"entity_rules": [
{
"rule_condition": "AND",
"rule_items": [
{
"field": "itsi_policy_title",
"field_type": "alias",
"rule_type": "matchesblank",
"value": ""
}
]
}
],
"key": "da-itsi-cp-monitoring-alerting-itsi-episode-analytics",
"kpis": [
{
"adaptive_thresholding_training_window": "-7d",
"adaptive_thresholds_is_enabled": false,
"aggregate_eval": "",
"aggregate_statop": "avg",
"aggregate_threshold_alert_enabled": false,
"aggregate_thresholds": {
"base_severity_color": "#99D18B",
"base_severity_color_light": "#DCEFD7",
"base_severity_label": "normal",
"base_severity_value": 2.0,
"gauge_max": 100,
"gauge_min": 0,
"is_max_static": false,
"is_min_static": true,
"metric_field": "count",
"render_boundary_max": 100.0,
"render_boundary_min": 0.0,
"threshold_levels": [
{
"dynamic_param": null,
"severity_color": "#B50101",
"severity_color_light": "#E5A6A6",
"severity_label": "critical",
"severity_label_localized": null,
"severity_value": 6.0,
"threshold_value": 0.0
},
{
"dynamic_param": null,
"severity_color": "#F26A35",
"severity_color_light": "#FBCBB9",
"severity_label": "high",
"severity_label_localized": null,
"severity_value": 5.0,
"threshold_value": 20.0
},
{
"dynamic_param": null,
"severity_color": "#FCB64E",
"severity_color_light": "#FEE6C1",
"severity_label": "medium",
"severity_label_localized": null,
"severity_value": 4.0,
"threshold_value": 40.0
},
{
"dynamic_param": null,
"severity_color": "#FFE98C",
"severity_color_light": "#FFF4C5",
"severity_label": "low",
"severity_label_localized": null,
"severity_value": 3.0,
"threshold_value": 60.0
},
{
"dynamic_param": null,
"severity_color": "#99D18B",
"severity_color_light": "#DCEFD7",
"severity_label": "normal",
"severity_label_localized": null,
"severity_value": 2.0,
"threshold_value": 80.0
}
]
},
"aggregate_thresholds_alert_enabled": false,
"aggregate_thresholds_custom_alert_enabled": false,
"aggregate_thresholds_custom_alert_rules": [],
"alert_eval": "",
"alert_lag": "30",
"alert_on": "both",
"alert_period": "1",
"anomaly_detection_alerting_enabled": false,
"anomaly_detection_is_enabled": false,
"anomaly_detection_sensitivity": 0.999,
"anomaly_detection_training_window": "-7d",
"backfill_earliest_time": "-7d",
"backfill_enabled": false,
"base_search": "`get_full_itsi_summary_service_health_events(da-itsi-cp-monitoring-alerting-itsi-episode-analytics)`",
"base_search_id": null,
"base_search_metric": null,
"cohesive_ad": {
"sensitivity": 8
},
"cohesive_anomaly_detection_is_enabled": false,
"datamodel": {
"datamodel": "",
"field": "",
"object": "",
"owner_field": ""
},
"datamodel_filter": [],
"datamodel_filter_clauses": null,
"description": "",
"enabled": false,
"entity_filter_field": "",
"entity_split_field": "",
"entity_statop": "avg",
"entity_thresholds": {
"base_severity_color": "#99D18B",
"base_severity_color_light": "#DCEFD7",
"base_severity_label": "normal",
"base_severity_value": 2.0,
"gauge_max": 100,
"gauge_min": 0,
"is_max_static": false,
"is_min_static": true,
"metric_field": "count",
"render_boundary_max": 100.0,
"render_boundary_min": 0.0,
"threshold_levels": [
{
"dynamic_param": null,
"severity_color": "#B50101",
"severity_color_light": "#E5A6A6",
"severity_label": "critical",
"severity_label_localized": null,
"severity_value": 6.0,
"threshold_value": 0.0
},
{
"dynamic_param": null,
"severity_color": "#F26A35",
"severity_color_light": "#FBCBB9",
"severity_label": "high",
"severity_label_localized": null,
"severity_value": 5.0,
"threshold_value": 20.0
},
{
"dynamic_param": null,
"severity_color": "#FCB64E",
"severity_color_light": "#FEE6C1",
"severity_label": "medium",
"severity_label_localized": null,
"severity_value": 4.0,
"threshold_value": 40.0
},
{
"dynamic_param": null,
"severity_color": "#FFE98C",
"severity_color_light": "#FFF4C5",
"severity_label": "low",
"severity_label_localized": null,
"severity_value": 3.0,
"threshold_value": 60.0
},
{
"dynamic_param": null,
"severity_color": "#99D18B",
"severity_color_light": "#DCEFD7",
"severity_label": "normal",
"severity_label_localized": null,
"severity_value": 2.0,
"threshold_value": 80.0
}
]
},
"fill_gaps": "null_value",
"gap_custom_alert_value": 0.0,
"gap_severity": "unknown",
"gap_severity_color": "#CCCCCC",
"gap_severity_color_light": "#EEEEEE",
"gap_severity_value": "-1",
"is_filter_entities_to_service": false,
"is_split_by_entity": false,
"key": "SHKPI-da-itsi-cp-monitoring-alerting-itsi-episode-analytics",
"kpi_base_search": "",
"kpi_template_kpi_id": "",
"kpi_threshold_template_id": "",
"metric_qualifier": null,
"metric_search_spec": {
"metric_index": "",
"metric_name": ""
},
"search": "`get_full_itsi_summary_service_health_events(da-itsi-cp-monitoring-alerting-itsi-episode-analytics)` | stats latest(health_score) AS aggregate",
"search_aggregate": "`get_full_itsi_summary_service_health_events(da-itsi-cp-monitoring-alerting-itsi-episode-analytics)` | stats latest(health_score) AS aggregate",
"search_alert": "",
"search_alert_earliest": "15",
"search_alert_entities": "",
"search_buckets": "",
"search_entities": null,
"search_occurrences": 1.0,
"search_time_compare": "`get_full_itsi_summary_service_health_events(da-itsi-cp-monitoring-alerting-itsi-episode-analytics)` [| stats count | addinfo | eval search= \"earliest=\" + tostring(info_min_time-(info_max_time-info_min_time))+ \" latest=\" + tostring(info_max_time) |fields search] | addinfo | eval bucket=if(_time<info_max_time-((info_max_time-info_min_time)/2), \"last_window\", \"current_window\") | stats avg(health_score) AS aggregate BY bucket | reverse | delta aggregate AS window_delta | search bucket=current_window | eval window_direction=if(window_delta >0, \"increase\", if(window_delta < 0, \"decrease\", \"none\"))",
"search_time_series": "`get_full_itsi_summary_service_health_events(da-itsi-cp-monitoring-alerting-itsi-episode-analytics)` | timechart avg(health_score) AS aggregate",
"search_time_series_aggregate": "`get_full_itsi_summary_service_health_events(da-itsi-cp-monitoring-alerting-itsi-episode-analytics)` | timechart avg(health_score) AS aggregate",
"search_time_series_entities": "",
"search_type": "adhoc",
"service_title": "ITSI Episode Analytics",
"threshold_eval": "",
"threshold_field": "aggregate",
"time_policies": {
"policies": {
"default_policy": {
"aggregate_thresholds": {
"base_severity_color": "#AED3E5",
"base_severity_color_light": "#E3F0F6",
"base_severity_label": "info",
"base_severity_value": 1.0,
"gauge_max": 100,
"gauge_min": 0,
"is_max_static": false,
"is_min_static": true,
"metric_field": "count",
"render_boundary_max": 100.0,
"render_boundary_min": 0.0,
"threshold_levels": []
},
"entity_thresholds": {
"base_severity_color": "#AED3E5",
"base_severity_color_light": "#E3F0F6",
"base_severity_label": "info",
"base_severity_value": 1.0,
"gauge_max": 100,
"gauge_min": 0,
"is_max_static": false,
"is_min_static": true,
"metric_field": "count",
"render_boundary_max": 100.0,
"render_boundary_min": 0.0,
"threshold_levels": []
},
"policy_type": "static",
"time_blocks": [],
"title": "Default"
}
}
},
"title": "ServiceHealthScore",
"trending_ad": {
"sensitivity": 8
},
"type": "service_health",
"tz_offset": null,
"unit": "",
"urgency": 11.0,
"use_time_policies": false
},
{
"adaptive_thresholding_training_window": "-7d",
"adaptive_thresholds_is_enabled": true,
"aggregate_eval": "",
"aggregate_statop": "sum",
"aggregate_threshold_alert_enabled": false,
"aggregate_thresholds": {
"base_severity_color": "#99D18B",
"base_severity_color_light": "#DCEFD7",
"base_severity_label": "normal",
"base_severity_value": 2.0,
"gauge_max": 100,
"gauge_min": 0,
"is_max_static": false,
"is_min_static": true,
"metric_field": "count",
"render_boundary_max": 100.0,
"render_boundary_min": 0.0,
"threshold_levels": []
},
"aggregate_thresholds_alert_enabled": false,
"aggregate_thresholds_custom_alert_enabled": false,
"aggregate_thresholds_custom_alert_rules": [],
"alert_eval": "",
"alert_lag": "30",
"alert_on": "both",
"alert_period": "1",
"anomaly_detection_alerting_enabled": false,
"anomaly_detection_is_enabled": false,
"anomaly_detection_sensitivity": null,
"anomaly_detection_training_window": null,
"backfill_earliest_time": "-7d",
"backfill_enabled": false,
"base_search": "| tstats values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` itsi_is_first_event=true by _time itsi_group_id itsi_policy_id span=1s\n| `itsi_notable_group_lookup`\n| eval severity_label=`itsi_get_severity_description(severity)`",
"base_search_id": "da-itsi-cp-monitoring-alerting-ea-new-episodes-by-severity",
"base_search_metric": "new-episode-count",
"cohesive_ad": {
"sensitivity": 8
},
"cohesive_anomaly_detection_is_enabled": false,
"datamodel": {
"datamodel": "",
"field": "",
"object": "",
"owner_field": ""
},
"datamodel_filter": [],
"datamodel_filter_clauses": null,
"description": "",
"enabled": true,
"entity_filter_field": "itsi_policy_id",
"entity_split_field": "severity_label",
"entity_statop": "count",
"entity_thresholds": {
"base_severity_color": "#99D18B",
"base_severity_color_light": "#DCEFD7",
"base_severity_label": "normal",
"base_severity_value": 2.0,
"gauge_max": 100,
"gauge_min": 0,
"is_max_static": false,
"is_min_static": true,
"metric_field": "count",
"render_boundary_max": 100.0,
"render_boundary_min": 0.0,
"threshold_levels": []
},
"fill_gaps": "custom_value",
"gap_custom_alert_value": 0.0,
"gap_severity": "unknown",
"gap_severity_color": "#CCCCCC",
"gap_severity_color_light": "#EEEEEE",
"gap_severity_value": "-1",
"is_filter_entities_to_service": true,
"is_split_by_entity": true,
"key": "da-itsi-cp-monitoring-alerting-d32d3955-5a1d-458a-9119-6ba7b5286252",
"kpi_base_search": "| tstats values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` itsi_is_first_event=true by _time itsi_group_id itsi_policy_id span=1s\n| `itsi_notable_group_lookup`\n| eval severity_label=`itsi_get_severity_description(severity)` | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-d32d3955-5a1d-458a-9119-6ba7b5286252 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ]",
"kpi_template_kpi_id": "",
"kpi_threshold_template_id": "da-itsi-cp-monitoring-alerting-ea-storm-detection-stddev",
"metric_qualifier": "",
"metric_search_spec": {
"metric_index": "",
"metric_name": ""
},
"search": "| tstats values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` itsi_is_first_event=true by _time itsi_group_id itsi_policy_id span=1s\n| `itsi_notable_group_lookup`\n| eval severity_label=`itsi_get_severity_description(severity)` | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-d32d3955-5a1d-458a-9119-6ba7b5286252 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_entity(count, itsi_group_id, \"severity_label\")` | eval sec_grp = \"default_itsi_security_group\" | `match_entities(severity_label, sec_grp)` | eval serviceid = \"da-itsi-cp-monitoring-alerting-itsi-episode-analytics\" | `aggregate_entity_into_service(sum)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-d32d3955-5a1d-458a-9119-6ba7b5286252, true, true, true)` | eval kpi=\"Episode Storm Detection\", urgency=\"11\", alert_period=\"1\", serviceid=\"da-itsi-cp-monitoring-alerting-itsi-episode-analytics\" | `assess_urgency` | `gettime`",
"search_aggregate": "| tstats values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` itsi_is_first_event=true by _time itsi_group_id itsi_policy_id span=1s\n| `itsi_notable_group_lookup`\n| eval severity_label=`itsi_get_severity_description(severity)` | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-d32d3955-5a1d-458a-9119-6ba7b5286252 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_single_value(count, sum, itsi_group_id, \"severity_label\", 15)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-d32d3955-5a1d-458a-9119-6ba7b5286252)`",
"search_alert": "| tstats values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` itsi_is_first_event=true by _time itsi_group_id itsi_policy_id span=1s\n| `itsi_notable_group_lookup`\n| eval severity_label=`itsi_get_severity_description(severity)` | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-d32d3955-5a1d-458a-9119-6ba7b5286252 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_entity(count, itsi_group_id, \"severity_label\")` | eval sec_grp = \"default_itsi_security_group\" | `match_entities(severity_label, sec_grp)` | eval serviceid = \"da-itsi-cp-monitoring-alerting-itsi-episode-analytics\" | `aggregate_entity_into_service(sum)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-d32d3955-5a1d-458a-9119-6ba7b5286252, true, true, true)` | eval kpi=\"Episode Storm Detection\", urgency=\"11\", alert_period=\"1\", serviceid=\"da-itsi-cp-monitoring-alerting-itsi-episode-analytics\" | `assess_urgency` | `gettime`",
"search_alert_earliest": "15",
"search_alert_entities": "",
"search_buckets": "",
"search_entities": "| tstats values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` itsi_is_first_event=true by _time itsi_group_id itsi_policy_id span=1s\n| `itsi_notable_group_lookup`\n| eval severity_label=`itsi_get_severity_description(severity)` | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-d32d3955-5a1d-458a-9119-6ba7b5286252 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_single_value(count, sum, itsi_group_id, \"severity_label\", 15)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-d32d3955-5a1d-458a-9119-6ba7b5286252)`",
"search_occurrences": 1.0,
"search_time_compare": "| tstats values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` itsi_is_first_event=true by _time itsi_group_id itsi_policy_id span=1s\n| `itsi_notable_group_lookup`\n| eval severity_label=`itsi_get_severity_description(severity)` | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-d32d3955-5a1d-458a-9119-6ba7b5286252 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_and_compare(count, sum, itsi_group_id, \"severity_label\", 15)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-d32d3955-5a1d-458a-9119-6ba7b5286252)`",
"search_time_series": "| tstats values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` itsi_is_first_event=true by _time itsi_group_id itsi_policy_id span=1s\n| `itsi_notable_group_lookup`\n| eval severity_label=`itsi_get_severity_description(severity)` | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-d32d3955-5a1d-458a-9119-6ba7b5286252 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_entity_time_series(count, itsi_group_id, \"severity_label\", 15)` | `aggregate_entity_into_service_time_series(sum, 15)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-d32d3955-5a1d-458a-9119-6ba7b5286252)`",
"search_time_series_aggregate": "| tstats values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` itsi_is_first_event=true by _time itsi_group_id itsi_policy_id span=1s\n| `itsi_notable_group_lookup`\n| eval severity_label=`itsi_get_severity_description(severity)` | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-d32d3955-5a1d-458a-9119-6ba7b5286252 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_entity_time_series(count, itsi_group_id, \"severity_label\", 15)` | `aggregate_entity_into_service_time_series(sum, 15)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-d32d3955-5a1d-458a-9119-6ba7b5286252)`",
"search_time_series_entities": "| tstats values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` itsi_is_first_event=true by _time itsi_group_id itsi_policy_id span=1s\n| `itsi_notable_group_lookup`\n| eval severity_label=`itsi_get_severity_description(severity)` | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-d32d3955-5a1d-458a-9119-6ba7b5286252 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_limited_entity_time_series(count, itsi_group_id, \"severity_label\", 15)`",
"search_type": "shared_base",
"service_title": "ITSI Episode Analytics",
"threshold_eval": "",
"threshold_field": "itsi_group_id",
"time_policies": {
"policies": {
"default_policy": {
"aggregate_thresholds": {
"base_severity_color": "#99D18B",
"base_severity_color_light": "#DCEFD7",
"base_severity_label": "normal",
"base_severity_value": 2.0,
"gauge_max": 96,
"gauge_min": 0,
"is_max_static": false,
"is_min_static": true,
"metric_field": "count",
"render_boundary_max": 100.0,
"render_boundary_min": 0.0,
"threshold_levels": [
{
"dynamic_param": 2.0,
"severity_color": "#FCB64E",
"severity_color_light": "#FEE6C1",
"severity_label": "medium",
"severity_label_localized": "Medium",
"severity_value": 4.0,
"threshold_value": 17.260858121465123
},
{
"dynamic_param": 2.5,
"severity_color": "#F26A35",
"severity_color_light": "#FBCBB9",
"severity_label": "high",
"severity_label_localized": "High",
"severity_value": 5.0,
"threshold_value": 19.310668323813182
},
{
"dynamic_param": 3.0,
"severity_color": "#B50101",
"severity_color_light": "#E5A6A6",
"severity_label": "critical",
"severity_label_localized": "Critical",
"severity_value": 6.0,
"threshold_value": 21.360478526161238
}
]
},
"entity_thresholds": {
"base_severity_color": "#AED3E5",
"base_severity_color_light": "#E3F0F6",
"base_severity_label": "info",
"base_severity_value": 1.0,
"gauge_max": 100,
"gauge_min": 0,
"is_max_static": false,
"is_min_static": true,
"metric_field": "count",
"render_boundary_max": 100.0,
"render_boundary_min": 0.0,
"threshold_levels": []
},
"policy_type": "stdev",
"time_blocks": [],
"title": "Default"
}
}
},
"title": "Episode Storm Detection",
"trending_ad": {
"sensitivity": 8
},
"type": "kpis_primary",
"tz_offset": null,
"unit": "",
"urgency": 11.0,
"use_time_policies": true
},
{
"adaptive_thresholding_training_window": "-7d",
"adaptive_thresholds_is_enabled": false,
"aggregate_eval": "",
"aggregate_statop": "sum",
"aggregate_threshold_alert_enabled": false,
"aggregate_thresholds": {
"base_severity_color": "#AED3E5",
"base_severity_color_light": "#E3F0F6",
"base_severity_label": "info",
"base_severity_value": 1.0,
"gauge_max": 100,
"gauge_min": 0,
"is_max_static": false,
"is_min_static": true,
"metric_field": "count",
"render_boundary_max": 100.0,
"render_boundary_min": 0.0,
"threshold_levels": []
},
"aggregate_thresholds_alert_enabled": false,
"aggregate_thresholds_custom_alert_enabled": false,
"aggregate_thresholds_custom_alert_rules": [],
"alert_eval": "",
"alert_lag": "30",
"alert_on": "both",
"alert_period": "1",
"anomaly_detection_alerting_enabled": false,
"anomaly_detection_is_enabled": false,
"anomaly_detection_sensitivity": null,
"anomaly_detection_training_window": null,
"backfill_earliest_time": "-7d",
"backfill_enabled": false,
"base_search": "| tstats values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` itsi_is_first_event=true by _time itsi_group_id itsi_policy_id span=1s\n\n| join itsi_policy_id [| rest report_as=text splunk_server=local /servicesNS/nobody/SA-ITOA/event_management_interface/notable_event_aggregation_policy\n| eval value = spath(value, \"{}\")\n| mvexpand value\n| eval itsi_policy_id = spath(value, \"_key\"), itsi_policy_title = spath(value, \"title\")\n| table itsi_policy_id itsi_policy_title ]",
"base_search_id": "da-itsi-cp-monitoring-alerting-ea-new-episodes-by-policy",
"base_search_metric": "new-episode-count",
"cohesive_ad": {
"sensitivity": 8
},
"cohesive_anomaly_detection_is_enabled": false,
"datamodel": {
"datamodel": "",
"field": "",
"object": "",
"owner_field": ""
},
"datamodel_filter": [],
"datamodel_filter_clauses": null,
"description": "",
"enabled": true,
"entity_filter_field": "itsi_policy_id",
"entity_split_field": "itsi_policy_title",
"entity_statop": "count",
"entity_thresholds": {
"base_severity_color": "#AED3E5",
"base_severity_color_light": "#E3F0F6",
"base_severity_label": "info",
"base_severity_value": 1.0,
"gauge_max": 100,
"gauge_min": 0,
"is_max_static": false,
"is_min_static": true,
"metric_field": "count",
"render_boundary_max": 7.6,
"render_boundary_min": 0.0,
"threshold_levels": []
},
"fill_gaps": "custom_value",
"gap_custom_alert_value": 0.0,
"gap_severity": "unknown",
"gap_severity_color": "#CCCCCC",
"gap_severity_color_light": "#EEEEEE",
"gap_severity_value": "-1",
"is_filter_entities_to_service": true,
"is_split_by_entity": true,
"key": "da-itsi-cp-monitoring-alerting-aa7948ae-10fe-4a2c-975c-680c4efb16b3",
"kpi_base_search": "| tstats values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` itsi_is_first_event=true by _time itsi_group_id itsi_policy_id span=1s\n\n| join itsi_policy_id [| rest report_as=text splunk_server=local /servicesNS/nobody/SA-ITOA/event_management_interface/notable_event_aggregation_policy\n| eval value = spath(value, \"{}\")\n| mvexpand value\n| eval itsi_policy_id = spath(value, \"_key\"), itsi_policy_title = spath(value, \"title\")\n| table itsi_policy_id itsi_policy_title ] | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-aa7948ae-10fe-4a2c-975c-680c4efb16b3 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ]",
"kpi_template_kpi_id": "",
"kpi_threshold_template_id": "",
"metric_qualifier": "",
"metric_search_spec": {
"metric_index": "",
"metric_name": ""
},
"search": "| tstats values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` itsi_is_first_event=true by _time itsi_group_id itsi_policy_id span=1s\n\n| join itsi_policy_id [| rest report_as=text splunk_server=local /servicesNS/nobody/SA-ITOA/event_management_interface/notable_event_aggregation_policy\n| eval value = spath(value, \"{}\")\n| mvexpand value\n| eval itsi_policy_id = spath(value, \"_key\"), itsi_policy_title = spath(value, \"title\")\n| table itsi_policy_id itsi_policy_title ] | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-aa7948ae-10fe-4a2c-975c-680c4efb16b3 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_entity(count, itsi_group_id, \"itsi_policy_title\")` | eval sec_grp = \"default_itsi_security_group\" | `match_entities(itsi_policy_title, sec_grp)` | eval serviceid = \"da-itsi-cp-monitoring-alerting-itsi-episode-analytics\" | `aggregate_entity_into_service(sum)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-aa7948ae-10fe-4a2c-975c-680c4efb16b3, true, true, true)` | eval kpi=\"New Episodes by Policy\", urgency=\"0\", alert_period=\"1\", serviceid=\"da-itsi-cp-monitoring-alerting-itsi-episode-analytics\" | `assess_urgency` | `gettime`",
"search_aggregate": "| tstats values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` itsi_is_first_event=true by _time itsi_group_id itsi_policy_id span=1s\n\n| join itsi_policy_id [| rest report_as=text splunk_server=local /servicesNS/nobody/SA-ITOA/event_management_interface/notable_event_aggregation_policy\n| eval value = spath(value, \"{}\")\n| mvexpand value\n| eval itsi_policy_id = spath(value, \"_key\"), itsi_policy_title = spath(value, \"title\")\n| table itsi_policy_id itsi_policy_title ] | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-aa7948ae-10fe-4a2c-975c-680c4efb16b3 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_single_value(count, sum, itsi_group_id, \"itsi_policy_title\", 15)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-aa7948ae-10fe-4a2c-975c-680c4efb16b3)`",
"search_alert": "| tstats values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` itsi_is_first_event=true by _time itsi_group_id itsi_policy_id span=1s\n\n| join itsi_policy_id [| rest report_as=text splunk_server=local /servicesNS/nobody/SA-ITOA/event_management_interface/notable_event_aggregation_policy\n| eval value = spath(value, \"{}\")\n| mvexpand value\n| eval itsi_policy_id = spath(value, \"_key\"), itsi_policy_title = spath(value, \"title\")\n| table itsi_policy_id itsi_policy_title ] | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-aa7948ae-10fe-4a2c-975c-680c4efb16b3 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_entity(count, itsi_group_id, \"itsi_policy_title\")` | eval sec_grp = \"default_itsi_security_group\" | `match_entities(itsi_policy_title, sec_grp)` | eval serviceid = \"da-itsi-cp-monitoring-alerting-itsi-episode-analytics\" | `aggregate_entity_into_service(sum)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-aa7948ae-10fe-4a2c-975c-680c4efb16b3, true, true, true)` | eval kpi=\"New Episodes by Policy\", urgency=\"0\", alert_period=\"1\", serviceid=\"da-itsi-cp-monitoring-alerting-itsi-episode-analytics\" | `assess_urgency` | `gettime`",
"search_alert_earliest": "15",
"search_alert_entities": "",
"search_buckets": "",
"search_entities": "| tstats values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` itsi_is_first_event=true by _time itsi_group_id itsi_policy_id span=1s\n\n| join itsi_policy_id [| rest report_as=text splunk_server=local /servicesNS/nobody/SA-ITOA/event_management_interface/notable_event_aggregation_policy\n| eval value = spath(value, \"{}\")\n| mvexpand value\n| eval itsi_policy_id = spath(value, \"_key\"), itsi_policy_title = spath(value, \"title\")\n| table itsi_policy_id itsi_policy_title ] | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-aa7948ae-10fe-4a2c-975c-680c4efb16b3 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_single_value(count, sum, itsi_group_id, \"itsi_policy_title\", 15)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-aa7948ae-10fe-4a2c-975c-680c4efb16b3)`",
"search_occurrences": 1.0,
"search_time_compare": "| tstats values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` itsi_is_first_event=true by _time itsi_group_id itsi_policy_id span=1s\n\n| join itsi_policy_id [| rest report_as=text splunk_server=local /servicesNS/nobody/SA-ITOA/event_management_interface/notable_event_aggregation_policy\n| eval value = spath(value, \"{}\")\n| mvexpand value\n| eval itsi_policy_id = spath(value, \"_key\"), itsi_policy_title = spath(value, \"title\")\n| table itsi_policy_id itsi_policy_title ] | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-aa7948ae-10fe-4a2c-975c-680c4efb16b3 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_and_compare(count, sum, itsi_group_id, \"itsi_policy_title\", 15)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-aa7948ae-10fe-4a2c-975c-680c4efb16b3)`",
"search_time_series": "| tstats values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` itsi_is_first_event=true by _time itsi_group_id itsi_policy_id span=1s\n\n| join itsi_policy_id [| rest report_as=text splunk_server=local /servicesNS/nobody/SA-ITOA/event_management_interface/notable_event_aggregation_policy\n| eval value = spath(value, \"{}\")\n| mvexpand value\n| eval itsi_policy_id = spath(value, \"_key\"), itsi_policy_title = spath(value, \"title\")\n| table itsi_policy_id itsi_policy_title ] | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-aa7948ae-10fe-4a2c-975c-680c4efb16b3 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_entity_time_series(count, itsi_group_id, \"itsi_policy_title\", 15)` | `aggregate_entity_into_service_time_series(sum, 15)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-aa7948ae-10fe-4a2c-975c-680c4efb16b3)`",
"search_time_series_aggregate": "| tstats values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` itsi_is_first_event=true by _time itsi_group_id itsi_policy_id span=1s\n\n| join itsi_policy_id [| rest report_as=text splunk_server=local /servicesNS/nobody/SA-ITOA/event_management_interface/notable_event_aggregation_policy\n| eval value = spath(value, \"{}\")\n| mvexpand value\n| eval itsi_policy_id = spath(value, \"_key\"), itsi_policy_title = spath(value, \"title\")\n| table itsi_policy_id itsi_policy_title ] | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-aa7948ae-10fe-4a2c-975c-680c4efb16b3 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_entity_time_series(count, itsi_group_id, \"itsi_policy_title\", 15)` | `aggregate_entity_into_service_time_series(sum, 15)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-aa7948ae-10fe-4a2c-975c-680c4efb16b3)`",
"search_time_series_entities": "| tstats values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` itsi_is_first_event=true by _time itsi_group_id itsi_policy_id span=1s\n\n| join itsi_policy_id [| rest report_as=text splunk_server=local /servicesNS/nobody/SA-ITOA/event_management_interface/notable_event_aggregation_policy\n| eval value = spath(value, \"{}\")\n| mvexpand value\n| eval itsi_policy_id = spath(value, \"_key\"), itsi_policy_title = spath(value, \"title\")\n| table itsi_policy_id itsi_policy_title ] | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-aa7948ae-10fe-4a2c-975c-680c4efb16b3 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_limited_entity_time_series(count, itsi_group_id, \"itsi_policy_title\", 15)`",
"search_type": "shared_base",
"service_title": "ITSI Episode Analytics",
"threshold_eval": "",
"threshold_field": "itsi_group_id",
"time_policies": {
"policies": {
"default_policy": {
"aggregate_thresholds": {
"base_severity_color": "#99D18B",
"base_severity_color_light": "#DCEFD7",
"base_severity_label": "normal",
"base_severity_value": 2.0,
"gauge_max": 100,
"gauge_min": 0,
"is_max_static": false,
"is_min_static": true,
"metric_field": "count",
"render_boundary_max": 100.0,
"render_boundary_min": 0.0,
"threshold_levels": []
},
"entity_thresholds": {
"base_severity_color": "#99D18B",
"base_severity_color_light": "#DCEFD7",
"base_severity_label": "normal",
"base_severity_value": 2.0,
"gauge_max": 100,
"gauge_min": 0,
"is_max_static": false,
"is_min_static": true,
"metric_field": "count",
"render_boundary_max": 100.0,
"render_boundary_min": 0.0,
"threshold_levels": []
},
"policy_type": "static",
"time_blocks": [],
"title": "Default"
}
}
},
"title": "New Episodes by Policy",
"trending_ad": {
"sensitivity": 8
},
"type": "kpis_primary",
"tz_offset": null,
"unit": "",
"urgency": 0.0,
"use_time_policies": false
},
{
"adaptive_thresholding_training_window": "-7d",
"adaptive_thresholds_is_enabled": false,
"aggregate_eval": "",
"aggregate_statop": "sum",
"aggregate_threshold_alert_enabled": false,
"aggregate_thresholds": {
"base_severity_color": "#AED3E5",
"base_severity_color_light": "#E3F0F6",
"base_severity_label": "info",
"base_severity_value": 1.0,
"gauge_max": 100,
"gauge_min": 0,
"is_max_static": false,
"is_min_static": true,
"metric_field": "count",
"render_boundary_max": 100.0,
"render_boundary_min": 0.0,
"threshold_levels": []
},
"aggregate_thresholds_alert_enabled": false,
"aggregate_thresholds_custom_alert_enabled": false,
"aggregate_thresholds_custom_alert_rules": [],
"alert_eval": "",
"alert_lag": "30",
"alert_on": "both",
"alert_period": "1",
"anomaly_detection_alerting_enabled": false,
"anomaly_detection_is_enabled": false,
"anomaly_detection_sensitivity": null,
"anomaly_detection_training_window": null,
"backfill_earliest_time": "-7d",
"backfill_enabled": false,
"base_search": "| tstats max(_time) as _time values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` earliest=-14d@d by itsi_group_id itsi_policy_id\n| `itsi_notable_group_lookup` \n| eval severity_label = `itsi_get_severity_description(severity)` \n| eval status_label = case(status=1, \"New\", status=2, \"InProgress\", status=3, \"Pending\", status=4, \"Resolved\", status=5, \"Closed\")\n| search status IN (1, 2, 3, 4)",
"base_search_id": "da-itsi-cp-monitoring-alerting-ea-open-episodes-by-severity",
"base_search_metric": "open-episodes",
"cohesive_ad": {
"sensitivity": 8
},
"cohesive_anomaly_detection_is_enabled": false,
"datamodel": {
"datamodel": "",
"field": "",
"object": "",
"owner_field": ""
},
"datamodel_filter": [],
"datamodel_filter_clauses": null,
"description": "",
"enabled": true,
"entity_filter_field": "itsi_policy_id",
"entity_split_field": "severity_label",
"entity_statop": "dc",
"entity_thresholds": {
"base_severity_color": "#AED3E5",
"base_severity_color_light": "#E3F0F6",
"base_severity_label": "info",
"base_severity_value": 1.0,
"gauge_max": 100,
"gauge_min": 0,
"is_max_static": false,
"is_min_static": true,
"metric_field": "count",
"render_boundary_max": 100.0,
"render_boundary_min": 0.0,
"threshold_levels": []
},
"fill_gaps": "custom_value",
"gap_custom_alert_value": 0.0,
"gap_severity": "unknown",
"gap_severity_color": "#CCCCCC",
"gap_severity_color_light": "#EEEEEE",
"gap_severity_value": "-1",
"is_filter_entities_to_service": true,
"is_split_by_entity": true,
"key": "da-itsi-cp-monitoring-alerting-b74815b2-b4e9-4c4b-bfbf-d524eada7bf1",
"kpi_base_search": "| tstats max(_time) as _time values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` earliest=-14d@d by itsi_group_id itsi_policy_id\n| `itsi_notable_group_lookup` \n| eval severity_label = `itsi_get_severity_description(severity)` \n| eval status_label = case(status=1, \"New\", status=2, \"InProgress\", status=3, \"Pending\", status=4, \"Resolved\", status=5, \"Closed\")\n| search status IN (1, 2, 3, 4) | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-b74815b2-b4e9-4c4b-bfbf-d524eada7bf1 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ]",
"kpi_template_kpi_id": "",
"kpi_threshold_template_id": "",
"metric_qualifier": "",
"metric_search_spec": {
"metric_index": "",
"metric_name": ""
},
"search": "| tstats max(_time) as _time values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` earliest=-14d@d by itsi_group_id itsi_policy_id\n| `itsi_notable_group_lookup` \n| eval severity_label = `itsi_get_severity_description(severity)` \n| eval status_label = case(status=1, \"New\", status=2, \"InProgress\", status=3, \"Pending\", status=4, \"Resolved\", status=5, \"Closed\")\n| search status IN (1, 2, 3, 4) | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-b74815b2-b4e9-4c4b-bfbf-d524eada7bf1 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_entity(dc, itsi_group_id, \"severity_label\")` | eval sec_grp = \"default_itsi_security_group\" | `match_entities(severity_label, sec_grp)` | eval serviceid = \"da-itsi-cp-monitoring-alerting-itsi-episode-analytics\" | `aggregate_entity_into_service(sum)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-b74815b2-b4e9-4c4b-bfbf-d524eada7bf1, true, true, true)` | eval kpi=\"Open Episodes by Severity\", urgency=\"0\", alert_period=\"1\", serviceid=\"da-itsi-cp-monitoring-alerting-itsi-episode-analytics\" | `assess_urgency` | `gettime`",
"search_aggregate": "| tstats max(_time) as _time values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` earliest=-14d@d by itsi_group_id itsi_policy_id\n| `itsi_notable_group_lookup` \n| eval severity_label = `itsi_get_severity_description(severity)` \n| eval status_label = case(status=1, \"New\", status=2, \"InProgress\", status=3, \"Pending\", status=4, \"Resolved\", status=5, \"Closed\")\n| search status IN (1, 2, 3, 4) | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-b74815b2-b4e9-4c4b-bfbf-d524eada7bf1 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_single_value(dc, sum, itsi_group_id, \"severity_label\", 15)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-b74815b2-b4e9-4c4b-bfbf-d524eada7bf1)`",
"search_alert": "| tstats max(_time) as _time values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` earliest=-14d@d by itsi_group_id itsi_policy_id\n| `itsi_notable_group_lookup` \n| eval severity_label = `itsi_get_severity_description(severity)` \n| eval status_label = case(status=1, \"New\", status=2, \"InProgress\", status=3, \"Pending\", status=4, \"Resolved\", status=5, \"Closed\")\n| search status IN (1, 2, 3, 4) | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-b74815b2-b4e9-4c4b-bfbf-d524eada7bf1 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_entity(dc, itsi_group_id, \"severity_label\")` | eval sec_grp = \"default_itsi_security_group\" | `match_entities(severity_label, sec_grp)` | eval serviceid = \"da-itsi-cp-monitoring-alerting-itsi-episode-analytics\" | `aggregate_entity_into_service(sum)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-b74815b2-b4e9-4c4b-bfbf-d524eada7bf1, true, true, true)` | eval kpi=\"Open Episodes by Severity\", urgency=\"0\", alert_period=\"1\", serviceid=\"da-itsi-cp-monitoring-alerting-itsi-episode-analytics\" | `assess_urgency` | `gettime`",
"search_alert_earliest": "15",
"search_alert_entities": "",
"search_buckets": "",
"search_entities": "| tstats max(_time) as _time values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` earliest=-14d@d by itsi_group_id itsi_policy_id\n| `itsi_notable_group_lookup` \n| eval severity_label = `itsi_get_severity_description(severity)` \n| eval status_label = case(status=1, \"New\", status=2, \"InProgress\", status=3, \"Pending\", status=4, \"Resolved\", status=5, \"Closed\")\n| search status IN (1, 2, 3, 4) | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-b74815b2-b4e9-4c4b-bfbf-d524eada7bf1 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_single_value(dc, sum, itsi_group_id, \"severity_label\", 15)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-b74815b2-b4e9-4c4b-bfbf-d524eada7bf1)`",
"search_occurrences": 1.0,
"search_time_compare": "| tstats max(_time) as _time values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` earliest=-14d@d by itsi_group_id itsi_policy_id\n| `itsi_notable_group_lookup` \n| eval severity_label = `itsi_get_severity_description(severity)` \n| eval status_label = case(status=1, \"New\", status=2, \"InProgress\", status=3, \"Pending\", status=4, \"Resolved\", status=5, \"Closed\")\n| search status IN (1, 2, 3, 4) | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-b74815b2-b4e9-4c4b-bfbf-d524eada7bf1 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_and_compare(dc, sum, itsi_group_id, \"severity_label\", 15)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-b74815b2-b4e9-4c4b-bfbf-d524eada7bf1)`",
"search_time_series": "| tstats max(_time) as _time values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` earliest=-14d@d by itsi_group_id itsi_policy_id\n| `itsi_notable_group_lookup` \n| eval severity_label = `itsi_get_severity_description(severity)` \n| eval status_label = case(status=1, \"New\", status=2, \"InProgress\", status=3, \"Pending\", status=4, \"Resolved\", status=5, \"Closed\")\n| search status IN (1, 2, 3, 4) | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-b74815b2-b4e9-4c4b-bfbf-d524eada7bf1 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_entity_time_series(dc, itsi_group_id, \"severity_label\", 15)` | `aggregate_entity_into_service_time_series(sum, 15)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-b74815b2-b4e9-4c4b-bfbf-d524eada7bf1)`",
"search_time_series_aggregate": "| tstats max(_time) as _time values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` earliest=-14d@d by itsi_group_id itsi_policy_id\n| `itsi_notable_group_lookup` \n| eval severity_label = `itsi_get_severity_description(severity)` \n| eval status_label = case(status=1, \"New\", status=2, \"InProgress\", status=3, \"Pending\", status=4, \"Resolved\", status=5, \"Closed\")\n| search status IN (1, 2, 3, 4) | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-b74815b2-b4e9-4c4b-bfbf-d524eada7bf1 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_entity_time_series(dc, itsi_group_id, \"severity_label\", 15)` | `aggregate_entity_into_service_time_series(sum, 15)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-b74815b2-b4e9-4c4b-bfbf-d524eada7bf1)`",
"search_time_series_entities": "| tstats max(_time) as _time values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` earliest=-14d@d by itsi_group_id itsi_policy_id\n| `itsi_notable_group_lookup` \n| eval severity_label = `itsi_get_severity_description(severity)` \n| eval status_label = case(status=1, \"New\", status=2, \"InProgress\", status=3, \"Pending\", status=4, \"Resolved\", status=5, \"Closed\")\n| search status IN (1, 2, 3, 4) | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-b74815b2-b4e9-4c4b-bfbf-d524eada7bf1 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_limited_entity_time_series(dc, itsi_group_id, \"severity_label\", 15)`",
"search_type": "shared_base",
"service_title": "ITSI Episode Analytics",
"threshold_eval": "",
"threshold_field": "itsi_group_id",
"time_policies": {
"policies": {
"default_policy": {
"aggregate_thresholds": {
"base_severity_color": "#99D18B",
"base_severity_color_light": "#DCEFD7",
"base_severity_label": "normal",
"base_severity_value": 2.0,
"gauge_max": 100,
"gauge_min": 0,
"is_max_static": false,
"is_min_static": true,
"metric_field": "count",
"render_boundary_max": 100.0,
"render_boundary_min": 0.0,
"threshold_levels": []
},
"entity_thresholds": {
"base_severity_color": "#99D18B",
"base_severity_color_light": "#DCEFD7",
"base_severity_label": "normal",
"base_severity_value": 2.0,
"gauge_max": 100,
"gauge_min": 0,
"is_max_static": false,
"is_min_static": true,
"metric_field": "count",
"render_boundary_max": 100.0,
"render_boundary_min": 0.0,
"threshold_levels": []
},
"policy_type": "static",
"time_blocks": [],
"title": "Default"
}
}
},
"title": "Open Episodes by Severity",
"trending_ad": {
"sensitivity": 8
},
"type": "kpis_primary",
"tz_offset": null,
"unit": "",
"urgency": 0.0,
"use_time_policies": false
},
{
"adaptive_thresholding_training_window": "-7d",
"adaptive_thresholds_is_enabled": false,
"aggregate_eval": "",
"aggregate_statop": "sum",
"aggregate_threshold_alert_enabled": false,
"aggregate_thresholds": {
"base_severity_color": "#AED3E5",
"base_severity_color_light": "#E3F0F6",
"base_severity_label": "info",
"base_severity_value": 1.0,
"gauge_max": 100,
"gauge_min": 0,
"is_max_static": false,
"is_min_static": true,
"metric_field": "count",
"render_boundary_max": 100.0,
"render_boundary_min": 0.0,
"threshold_levels": []
},
"aggregate_thresholds_alert_enabled": false,
"aggregate_thresholds_custom_alert_enabled": false,
"aggregate_thresholds_custom_alert_rules": [],
"alert_eval": "",
"alert_lag": "30",
"alert_on": "both",
"alert_period": "1",
"anomaly_detection_alerting_enabled": false,
"anomaly_detection_is_enabled": false,
"anomaly_detection_sensitivity": null,
"anomaly_detection_training_window": null,
"backfill_earliest_time": "-7d",
"backfill_enabled": false,
"base_search": "| tstats max(_time) as _time values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` earliest=-14d@d by itsi_group_id itsi_policy_id\n| `itsi_notable_group_lookup` \n| eval severity_label = `itsi_get_severity_description(severity)` \n| eval status_label = case(status=1, \"New\", status=2, \"InProgress\", status=3, \"Pending\", status=4, \"Resolved\", status=5, \"Closed\")\n| search status IN (1, 2, 3, 4)",
"base_search_id": "da-itsi-cp-monitoring-alerting-ea-open-episodes-by-status",
"base_search_metric": "open-episodes",
"cohesive_ad": {
"sensitivity": 8
},
"cohesive_anomaly_detection_is_enabled": false,
"datamodel": {
"datamodel": "",
"field": "",
"object": "",
"owner_field": ""
},
"datamodel_filter": [],
"datamodel_filter_clauses": null,
"description": "",
"enabled": true,
"entity_filter_field": "itsi_policy_id",
"entity_split_field": "status_label",
"entity_statop": "dc",
"entity_thresholds": {
"base_severity_color": "#AED3E5",
"base_severity_color_light": "#E3F0F6",
"base_severity_label": "info",
"base_severity_value": 1.0,
"gauge_max": 100,
"gauge_min": 0,
"is_max_static": false,
"is_min_static": true,
"metric_field": "count",
"render_boundary_max": 100.0,
"render_boundary_min": 0.0,
"threshold_levels": []
},
"fill_gaps": "custom_value",
"gap_custom_alert_value": 0.0,
"gap_severity": "unknown",
"gap_severity_color": "#CCCCCC",
"gap_severity_color_light": "#EEEEEE",
"gap_severity_value": "-1",
"is_filter_entities_to_service": true,
"is_split_by_entity": true,
"key": "da-itsi-cp-monitoring-alerting-01314122-bf3f-439f-9cc9-904c78c929f3",
"kpi_base_search": "| tstats max(_time) as _time values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` earliest=-14d@d by itsi_group_id itsi_policy_id\n| `itsi_notable_group_lookup` \n| eval severity_label = `itsi_get_severity_description(severity)` \n| eval status_label = case(status=1, \"New\", status=2, \"InProgress\", status=3, \"Pending\", status=4, \"Resolved\", status=5, \"Closed\")\n| search status IN (1, 2, 3, 4) | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-01314122-bf3f-439f-9cc9-904c78c929f3 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ]",
"kpi_template_kpi_id": "",
"kpi_threshold_template_id": "",
"metric_qualifier": "",
"metric_search_spec": {
"metric_index": "",
"metric_name": ""
},
"search": "| tstats max(_time) as _time values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` earliest=-14d@d by itsi_group_id itsi_policy_id\n| `itsi_notable_group_lookup` \n| eval severity_label = `itsi_get_severity_description(severity)` \n| eval status_label = case(status=1, \"New\", status=2, \"InProgress\", status=3, \"Pending\", status=4, \"Resolved\", status=5, \"Closed\")\n| search status IN (1, 2, 3, 4) | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-01314122-bf3f-439f-9cc9-904c78c929f3 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_entity(dc, itsi_group_id, \"status_label\")` | eval sec_grp = \"default_itsi_security_group\" | `match_entities(status_label, sec_grp)` | eval serviceid = \"da-itsi-cp-monitoring-alerting-itsi-episode-analytics\" | `aggregate_entity_into_service(sum)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-01314122-bf3f-439f-9cc9-904c78c929f3, true, true, true)` | eval kpi=\"Open Episodes by Status\", urgency=\"0\", alert_period=\"1\", serviceid=\"da-itsi-cp-monitoring-alerting-itsi-episode-analytics\" | `assess_urgency` | `gettime`",
"search_aggregate": "| tstats max(_time) as _time values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` earliest=-14d@d by itsi_group_id itsi_policy_id\n| `itsi_notable_group_lookup` \n| eval severity_label = `itsi_get_severity_description(severity)` \n| eval status_label = case(status=1, \"New\", status=2, \"InProgress\", status=3, \"Pending\", status=4, \"Resolved\", status=5, \"Closed\")\n| search status IN (1, 2, 3, 4) | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-01314122-bf3f-439f-9cc9-904c78c929f3 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_single_value(dc, sum, itsi_group_id, \"status_label\", 15)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-01314122-bf3f-439f-9cc9-904c78c929f3)`",
"search_alert": "| tstats max(_time) as _time values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` earliest=-14d@d by itsi_group_id itsi_policy_id\n| `itsi_notable_group_lookup` \n| eval severity_label = `itsi_get_severity_description(severity)` \n| eval status_label = case(status=1, \"New\", status=2, \"InProgress\", status=3, \"Pending\", status=4, \"Resolved\", status=5, \"Closed\")\n| search status IN (1, 2, 3, 4) | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-01314122-bf3f-439f-9cc9-904c78c929f3 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_entity(dc, itsi_group_id, \"status_label\")` | eval sec_grp = \"default_itsi_security_group\" | `match_entities(status_label, sec_grp)` | eval serviceid = \"da-itsi-cp-monitoring-alerting-itsi-episode-analytics\" | `aggregate_entity_into_service(sum)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-01314122-bf3f-439f-9cc9-904c78c929f3, true, true, true)` | eval kpi=\"Open Episodes by Status\", urgency=\"0\", alert_period=\"1\", serviceid=\"da-itsi-cp-monitoring-alerting-itsi-episode-analytics\" | `assess_urgency` | `gettime`",
"search_alert_earliest": "15",
"search_alert_entities": "",
"search_buckets": "",
"search_entities": "| tstats max(_time) as _time values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` earliest=-14d@d by itsi_group_id itsi_policy_id\n| `itsi_notable_group_lookup` \n| eval severity_label = `itsi_get_severity_description(severity)` \n| eval status_label = case(status=1, \"New\", status=2, \"InProgress\", status=3, \"Pending\", status=4, \"Resolved\", status=5, \"Closed\")\n| search status IN (1, 2, 3, 4) | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-01314122-bf3f-439f-9cc9-904c78c929f3 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_single_value(dc, sum, itsi_group_id, \"status_label\", 15)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-01314122-bf3f-439f-9cc9-904c78c929f3)`",
"search_occurrences": 1.0,
"search_time_compare": "| tstats max(_time) as _time values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` earliest=-14d@d by itsi_group_id itsi_policy_id\n| `itsi_notable_group_lookup` \n| eval severity_label = `itsi_get_severity_description(severity)` \n| eval status_label = case(status=1, \"New\", status=2, \"InProgress\", status=3, \"Pending\", status=4, \"Resolved\", status=5, \"Closed\")\n| search status IN (1, 2, 3, 4) | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-01314122-bf3f-439f-9cc9-904c78c929f3 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_and_compare(dc, sum, itsi_group_id, \"status_label\", 15)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-01314122-bf3f-439f-9cc9-904c78c929f3)`",
"search_time_series": "| tstats max(_time) as _time values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` earliest=-14d@d by itsi_group_id itsi_policy_id\n| `itsi_notable_group_lookup` \n| eval severity_label = `itsi_get_severity_description(severity)` \n| eval status_label = case(status=1, \"New\", status=2, \"InProgress\", status=3, \"Pending\", status=4, \"Resolved\", status=5, \"Closed\")\n| search status IN (1, 2, 3, 4) | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-01314122-bf3f-439f-9cc9-904c78c929f3 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_entity_time_series(dc, itsi_group_id, \"status_label\", 15)` | `aggregate_entity_into_service_time_series(sum, 15)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-01314122-bf3f-439f-9cc9-904c78c929f3)`",
"search_time_series_aggregate": "| tstats max(_time) as _time values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` earliest=-14d@d by itsi_group_id itsi_policy_id\n| `itsi_notable_group_lookup` \n| eval severity_label = `itsi_get_severity_description(severity)` \n| eval status_label = case(status=1, \"New\", status=2, \"InProgress\", status=3, \"Pending\", status=4, \"Resolved\", status=5, \"Closed\")\n| search status IN (1, 2, 3, 4) | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-01314122-bf3f-439f-9cc9-904c78c929f3 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_entity_time_series(dc, itsi_group_id, \"status_label\", 15)` | `aggregate_entity_into_service_time_series(sum, 15)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-01314122-bf3f-439f-9cc9-904c78c929f3)`",
"search_time_series_entities": "| tstats max(_time) as _time values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` earliest=-14d@d by itsi_group_id itsi_policy_id\n| `itsi_notable_group_lookup` \n| eval severity_label = `itsi_get_severity_description(severity)` \n| eval status_label = case(status=1, \"New\", status=2, \"InProgress\", status=3, \"Pending\", status=4, \"Resolved\", status=5, \"Closed\")\n| search status IN (1, 2, 3, 4) | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-01314122-bf3f-439f-9cc9-904c78c929f3 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_limited_entity_time_series(dc, itsi_group_id, \"status_label\", 15)`",
"search_type": "shared_base",
"service_title": "ITSI Episode Analytics",
"threshold_eval": "",
"threshold_field": "itsi_group_id",
"time_policies": {
"policies": {
"default_policy": {
"aggregate_thresholds": {
"base_severity_color": "#99D18B",
"base_severity_color_light": "#DCEFD7",
"base_severity_label": "normal",
"base_severity_value": 2.0,
"gauge_max": 100,
"gauge_min": 0,
"is_max_static": false,
"is_min_static": true,
"metric_field": "count",
"render_boundary_max": 100.0,
"render_boundary_min": 0.0,
"threshold_levels": []
},
"entity_thresholds": {
"base_severity_color": "#99D18B",
"base_severity_color_light": "#DCEFD7",
"base_severity_label": "normal",
"base_severity_value": 2.0,
"gauge_max": 100,
"gauge_min": 0,
"is_max_static": false,
"is_min_static": true,
"metric_field": "count",
"render_boundary_max": 100.0,
"render_boundary_min": 0.0,
"threshold_levels": []
},
"policy_type": "static",
"time_blocks": [],
"title": "Default"
}
}
},
"title": "Open Episodes by Status",
"trending_ad": {
"sensitivity": 8
},
"type": "kpis_primary",
"tz_offset": null,
"unit": "",
"urgency": 0.0,
"use_time_policies": false
},
{
"adaptive_thresholding_training_window": "-7d",
"adaptive_thresholds_is_enabled": true,
"aggregate_eval": "",
"aggregate_statop": "sum",
"aggregate_threshold_alert_enabled": false,
"aggregate_thresholds": {
"base_severity_color": "#99D18B",
"base_severity_color_light": "#DCEFD7",
"base_severity_label": "normal",
"base_severity_value": 2.0,
"gauge_max": 100,
"gauge_min": 0,
"is_max_static": false,
"is_min_static": true,
"metric_field": "count",
"render_boundary_max": 100.0,
"render_boundary_min": 0.0,
"threshold_levels": []
},
"aggregate_thresholds_alert_enabled": false,
"aggregate_thresholds_custom_alert_enabled": false,
"aggregate_thresholds_custom_alert_rules": [],
"alert_eval": "",
"alert_lag": "30",
"alert_on": "both",
"alert_period": "1",
"anomaly_detection_alerting_enabled": false,
"anomaly_detection_is_enabled": false,
"anomaly_detection_sensitivity": null,
"anomaly_detection_training_window": null,
"backfill_earliest_time": "-7d",
"backfill_enabled": false,
"base_search": "| tstats max(_time) as _time values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` earliest=-14d@d by itsi_group_id itsi_policy_id\n| `itsi_notable_group_lookup` \n| eval severity_label = `itsi_get_severity_description(severity)` \n| eval status_label = case(status=1, \"New\", status=2, \"InProgress\", status=3, \"Pending\", status=4, \"Resolved\", status=5, \"Closed\")\n| search status IN (1, 2, 3, 4)\n| search severity=6",
"base_search_id": "da-itsi-cp-monitoring-alerting-ea-open-crit-episodes-by-status",
"base_search_metric": "open-episodes",
"cohesive_ad": {
"sensitivity": 8
},
"cohesive_anomaly_detection_is_enabled": false,
"datamodel": {
"datamodel": "",
"field": "",
"object": "",
"owner_field": ""
},
"datamodel_filter": [],
"datamodel_filter_clauses": null,
"description": "",
"enabled": true,
"entity_filter_field": "itsi_policy_id",
"entity_split_field": "status_label",
"entity_statop": "dc",
"entity_thresholds": {
"base_severity_color": "#AED3E5",
"base_severity_color_light": "#E3F0F6",
"base_severity_label": "info",
"base_severity_value": 1.0,
"gauge_max": 100,
"gauge_min": 0,
"is_max_static": false,
"is_min_static": true,
"metric_field": "count",
"render_boundary_max": 23.0,
"render_boundary_min": 0.0,
"threshold_levels": []
},
"fill_gaps": "custom_value",
"gap_custom_alert_value": 0.0,
"gap_severity": "unknown",
"gap_severity_color": "#CCCCCC",
"gap_severity_color_light": "#EEEEEE",
"gap_severity_value": "-1",
"is_filter_entities_to_service": true,
"is_split_by_entity": true,
"key": "da-itsi-cp-monitoring-alerting-8f4bcc25-1e98-40b6-8b71-782a6bf1a5c3",
"kpi_base_search": "| tstats max(_time) as _time values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` earliest=-14d@d by itsi_group_id itsi_policy_id\n| `itsi_notable_group_lookup` \n| eval severity_label = `itsi_get_severity_description(severity)` \n| eval status_label = case(status=1, \"New\", status=2, \"InProgress\", status=3, \"Pending\", status=4, \"Resolved\", status=5, \"Closed\")\n| search status IN (1, 2, 3, 4)\n| search severity=6 | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-8f4bcc25-1e98-40b6-8b71-782a6bf1a5c3 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ]",
"kpi_template_kpi_id": "",
"kpi_threshold_template_id": "",
"metric_qualifier": "",
"metric_search_spec": {
"metric_index": "",
"metric_name": ""
},
"search": "| tstats max(_time) as _time values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` earliest=-14d@d by itsi_group_id itsi_policy_id\n| `itsi_notable_group_lookup` \n| eval severity_label = `itsi_get_severity_description(severity)` \n| eval status_label = case(status=1, \"New\", status=2, \"InProgress\", status=3, \"Pending\", status=4, \"Resolved\", status=5, \"Closed\")\n| search status IN (1, 2, 3, 4)\n| search severity=6 | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-8f4bcc25-1e98-40b6-8b71-782a6bf1a5c3 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_entity(dc, itsi_group_id, \"status_label\")` | eval sec_grp = \"default_itsi_security_group\" | `match_entities(status_label, sec_grp)` | eval serviceid = \"da-itsi-cp-monitoring-alerting-itsi-episode-analytics\" | `aggregate_entity_into_service(sum)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-8f4bcc25-1e98-40b6-8b71-782a6bf1a5c3, true, true, true)` | eval kpi=\"Open, Critical Episodes by Status\", urgency=\"5\", alert_period=\"1\", serviceid=\"da-itsi-cp-monitoring-alerting-itsi-episode-analytics\" | `assess_urgency` | `gettime`",
"search_aggregate": "| tstats max(_time) as _time values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` earliest=-14d@d by itsi_group_id itsi_policy_id\n| `itsi_notable_group_lookup` \n| eval severity_label = `itsi_get_severity_description(severity)` \n| eval status_label = case(status=1, \"New\", status=2, \"InProgress\", status=3, \"Pending\", status=4, \"Resolved\", status=5, \"Closed\")\n| search status IN (1, 2, 3, 4)\n| search severity=6 | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-8f4bcc25-1e98-40b6-8b71-782a6bf1a5c3 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_single_value(dc, sum, itsi_group_id, \"status_label\", 15)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-8f4bcc25-1e98-40b6-8b71-782a6bf1a5c3)`",
"search_alert": "| tstats max(_time) as _time values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` earliest=-14d@d by itsi_group_id itsi_policy_id\n| `itsi_notable_group_lookup` \n| eval severity_label = `itsi_get_severity_description(severity)` \n| eval status_label = case(status=1, \"New\", status=2, \"InProgress\", status=3, \"Pending\", status=4, \"Resolved\", status=5, \"Closed\")\n| search status IN (1, 2, 3, 4)\n| search severity=6 | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-8f4bcc25-1e98-40b6-8b71-782a6bf1a5c3 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_entity(dc, itsi_group_id, \"status_label\")` | eval sec_grp = \"default_itsi_security_group\" | `match_entities(status_label, sec_grp)` | eval serviceid = \"da-itsi-cp-monitoring-alerting-itsi-episode-analytics\" | `aggregate_entity_into_service(sum)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-8f4bcc25-1e98-40b6-8b71-782a6bf1a5c3, true, true, true)` | eval kpi=\"Open, Critical Episodes by Status\", urgency=\"5\", alert_period=\"1\", serviceid=\"da-itsi-cp-monitoring-alerting-itsi-episode-analytics\" | `assess_urgency` | `gettime`",
"search_alert_earliest": "15",
"search_alert_entities": "",
"search_buckets": "",
"search_entities": "| tstats max(_time) as _time values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` earliest=-14d@d by itsi_group_id itsi_policy_id\n| `itsi_notable_group_lookup` \n| eval severity_label = `itsi_get_severity_description(severity)` \n| eval status_label = case(status=1, \"New\", status=2, \"InProgress\", status=3, \"Pending\", status=4, \"Resolved\", status=5, \"Closed\")\n| search status IN (1, 2, 3, 4)\n| search severity=6 | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-8f4bcc25-1e98-40b6-8b71-782a6bf1a5c3 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_single_value(dc, sum, itsi_group_id, \"status_label\", 15)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-8f4bcc25-1e98-40b6-8b71-782a6bf1a5c3)`",
"search_occurrences": 1.0,
"search_time_compare": "| tstats max(_time) as _time values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` earliest=-14d@d by itsi_group_id itsi_policy_id\n| `itsi_notable_group_lookup` \n| eval severity_label = `itsi_get_severity_description(severity)` \n| eval status_label = case(status=1, \"New\", status=2, \"InProgress\", status=3, \"Pending\", status=4, \"Resolved\", status=5, \"Closed\")\n| search status IN (1, 2, 3, 4)\n| search severity=6 | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-8f4bcc25-1e98-40b6-8b71-782a6bf1a5c3 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_and_compare(dc, sum, itsi_group_id, \"status_label\", 15)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-8f4bcc25-1e98-40b6-8b71-782a6bf1a5c3)`",
"search_time_series": "| tstats max(_time) as _time values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` earliest=-14d@d by itsi_group_id itsi_policy_id\n| `itsi_notable_group_lookup` \n| eval severity_label = `itsi_get_severity_description(severity)` \n| eval status_label = case(status=1, \"New\", status=2, \"InProgress\", status=3, \"Pending\", status=4, \"Resolved\", status=5, \"Closed\")\n| search status IN (1, 2, 3, 4)\n| search severity=6 | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-8f4bcc25-1e98-40b6-8b71-782a6bf1a5c3 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_entity_time_series(dc, itsi_group_id, \"status_label\", 15)` | `aggregate_entity_into_service_time_series(sum, 15)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-8f4bcc25-1e98-40b6-8b71-782a6bf1a5c3)`",
"search_time_series_aggregate": "| tstats max(_time) as _time values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` earliest=-14d@d by itsi_group_id itsi_policy_id\n| `itsi_notable_group_lookup` \n| eval severity_label = `itsi_get_severity_description(severity)` \n| eval status_label = case(status=1, \"New\", status=2, \"InProgress\", status=3, \"Pending\", status=4, \"Resolved\", status=5, \"Closed\")\n| search status IN (1, 2, 3, 4)\n| search severity=6 | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-8f4bcc25-1e98-40b6-8b71-782a6bf1a5c3 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_entity_time_series(dc, itsi_group_id, \"status_label\", 15)` | `aggregate_entity_into_service_time_series(sum, 15)` | `assess_severity(da-itsi-cp-monitoring-alerting-itsi-episode-analytics, da-itsi-cp-monitoring-alerting-8f4bcc25-1e98-40b6-8b71-782a6bf1a5c3)`",
"search_time_series_entities": "| tstats max(_time) as _time values(itsi_group_title) as itsi_group_title where `itsi_event_management_group_index` earliest=-14d@d by itsi_group_id itsi_policy_id\n| `itsi_notable_group_lookup` \n| eval severity_label = `itsi_get_severity_description(severity)` \n| eval status_label = case(status=1, \"New\", status=2, \"InProgress\", status=3, \"Pending\", status=4, \"Resolved\", status=5, \"Closed\")\n| search status IN (1, 2, 3, 4)\n| search severity=6 | search [ | rest splunk_server=local report_as=text service_id=da-itsi-cp-monitoring-alerting-itsi-episode-analytics kpi_id=da-itsi-cp-monitoring-alerting-8f4bcc25-1e98-40b6-8b71-782a6bf1a5c3 entity_id_fields=itsi_policy_id entity_alias_filtering_fields=itsi_policy_id search_type=adhoc \"/servicesNS/nobody/SA-ITOA/itoa_interface/generate_entity_filter\" | return $value ] | `aggregate_raw_into_limited_entity_time_series(dc, itsi_group_id, \"status_label\", 15)`",
"search_type": "shared_base",
"service_title": "ITSI Episode Analytics",
"threshold_eval": "",
"threshold_field": "itsi_group_id",
"time_policies": {
"policies": {
"default_policy": {
"aggregate_thresholds": {
"base_severity_color": "#99D18B",
"base_severity_color_light": "#DCEFD7",
"base_severity_label": "normal",
"base_severity_value": 2.0,
"gauge_max": 204,
"gauge_min": 0,
"is_max_static": false,
"is_min_static": true,
"metric_field": "count",
"render_boundary_max": 204.39342723004694,
"render_boundary_min": 0.0,
"threshold_levels": [
{
"dynamic_param": 150.0,
"severity_color": "#FCB64E",
"severity_color_light": "#FEE6C1",
"severity_label": "medium",
"severity_label_localized": "Medium",
"severity_value": 4.0,
"threshold_value": 116.13262910798122
},
{
"dynamic_param": 200.0,
"severity_color": "#F26A35",
"severity_color_light": "#FBCBB9",
"severity_label": "high",
"severity_label_localized": "High",
"severity_value": 5.0,
"threshold_value": 139.35915492957747
},
{
"dynamic_param": 300.0,
"severity_color": "#B50101",
"severity_color_light": "#E5A6A6",
"severity_label": "critical",
"severity_label_localized": "Critical",
"severity_value": 6.0,
"threshold_value": 185.81220657276995
}
]
},
"entity_thresholds": {
"base_severity_color": "#99D18B",
"base_severity_color_light": "#DCEFD7",
"base_severity_label": "normal",
"base_severity_value": 2.0,
"gauge_max": 100,
"gauge_min": 0,
"is_max_static": false,
"is_min_static": true,
"metric_field": "count",
"render_boundary_max": 100.0,
"render_boundary_min": 0.0,
"threshold_levels": []
},
"policy_type": "static",
"time_blocks": [],
"title": "Default"
}
}
},
"title": "Open, Critical Episodes by Status",
"trending_ad": {
"sensitivity": 8
},
"type": "kpis_primary",
"tz_offset": null,
"unit": "",
"urgency": 5.0,
"use_time_policies": true
}
],
"service_tags": {
"tags": [],
"template_tags": []
},
"service_template_id": "da-itsi-cp-monitoring-alerting-itsi-episode-analytics-template",
"services_depending_on_me": [
{
"kpis_depending_on": [
"SHKPI-da-itsi-cp-monitoring-alerting-itsi-episode-analytics"
],
"service_id": "da-itsi-cp-monitoring-alerting-itsi-event-analytics"
}
],
"services_depends_on": [],
"team_id": "default_itsi_security_group",
"title": "ITSI Episode Analytics",
"version": "0.0.33"
}
Reference in new issue View Git Blame Copy Permalink