Once you’ve carefully planned a service—identified what it monitors, chosen KPIs, and defined dependencies—it’s time to put the plan into action in ITSI.
This process is called service implementation, and it’s done using a special tool in ITSI called the Service Editor.
Here’s a simple, step-by-step process to implement a service in ITSI:
In the ITSI interface, go to the Service Analyzer or Service Configuration page.
Click “Create New Service.”
Give the service a clear, meaningful name like:
“Payment Gateway”
“Internal Email Service”
“Customer Login Portal”
You can also:
Add a description
Assign a team owner (if already defined)
Every service needs KPIs to measure how healthy it is.
You can:
Create new KPIs from scratch by building new base searches
Select existing KPIs from a template or library
For each KPI, define:
The base search
Split-by fields (if needed)
Thresholds
Importance (weight in service health calculation)
Thresholds tell ITSI how to judge KPI values:
Normal
Warning
Critical
There are three types of thresholds you can use (explained more in the next section).
You can also apply Time Policies to make your thresholds behave differently at different times of day (e.g., relaxed at night).
If this service depends on other services, you can define that relationship:
Assign parent-child structure
This means that if a child service goes critical, the parent service health score is also affected
Example:
The “Checkout Service” depends on “Database Service” and “Inventory Service”.
Dependencies help you understand the chain of impact in your IT environment.
Each service should be managed by a team. In this step:
Assign the service to the correct ITSI team (e.g., “Database Ops”, “App Dev”)
Configure who can view or edit the service
Set access control based on user roles and responsibilities
This keeps your monitoring environment organized, secure, and team-driven.
When configuring KPIs in a service, you can choose from different types of threshold logic depending on the metric’s behavior.
Simple and fixed
Example: Error rate > 100 is “Critical”
Best for:
Based on trends or percentage changes
Example: If CPU usage increases 30% in 5 minutes, mark as “Warning”
Best for:
Uses historical data to learn “normal” patterns
Detects deviations from the learned baseline
Works even if you don’t know exact limits
Best for:
Complex environments
KPIs with unpredictable behavior
You can set:
Sensitivity level
Learning period
Re-training frequency
Time Policies let you apply different thresholds at different times of day. This is useful when system behavior naturally changes depending on the hour.
Example:
At night, user traffic is low → Allow higher error tolerance
During business hours, strict error limits are needed
Use Time Policies to:
Reduce false alerts during maintenance windows
Avoid unnecessary escalations
Improve alert accuracy by adapting to daily patterns
You can define time policies using a calendar-style interface or custom time ranges.
Service implementation is the hands-on process of building your designed services in ITSI.
You use the Service Editor to create services, assign KPIs, set thresholds, define dependencies, and configure access.
ITSI gives you flexible options for threshold logic: static, dynamic, or machine learning-based.
Use Time Policies to adjust KPI sensitivity based on business hours or known activity patterns.
While service templates are introduced during service design, it's important to understand how they function at the implementation stage to accelerate service creation.
When creating a new service in ITSI, you can select a pre-configured template from the dropdown in the Service Editor.
The template provides:
Predefined KPIs (with base searches and thresholds)
Time policies
Health scoring logic
This ensures consistency across services and reduces setup time.
Rapid onboarding of new services
Reduced human error in KPI setup
Easy bulk updates if the template is modified later
Tip: Templates can be customized per service after application, but the core structure remains intact.
Every service in ITSI has a Health Score, typically a number between 0–100, reflecting the overall health of the service.
The service health score is based on the status of all its KPIs.
Each KPI contributes to the health score based on:
Its severity level (Normal, Warning, Critical)
Its importance weight (assigned during configuration)
You may have three KPIs in a service:
CPU Load (weight 50%)
Disk Space (weight 30%)
Network Errors (weight 20%)
If CPU Load is Critical while others are Normal, the overall score will reflect that the most important metric is failing.
Tip: Carefully assign importance to each KPI during setup to align with business risk and operational impact.
Once a service is configured and KPIs are in place, it’s essential to validate the implementation before relying on it in production.
Push sample/test data to see how KPIs behave.
Use the Deep Dive tool to:
Visualize KPI behavior over time
Identify whether thresholds are too strict or too lenient
Detect missing data or unexpected status transitions
Optionally use:
The KPI Trend Analysis dashboard
ITSI Health Check to ensure data integrity and proper indexing
Tuning KPI thresholds to reduce false positives
Changing importance weights based on observed impact
Modifying base searches for better performance or relevance
Goal: Ensure that health scores and alerts accurately represent real-world service conditions.
Templates can significantly streamline the implementation process and enforce best practices.
Health scores depend on the behavior and weighting of KPIs—making it critical to assign meaningful importance levels.
After service deployment, run validation checks using tools like Deep Dive or test data to confirm that KPIs behave as expected and thresholds are effective.
What is a service in Splunk ITSI?
A logical representation of an IT system or application being monitored.
In ITSI, a service represents a logical grouping of infrastructure components, applications, or business systems that deliver functionality to users. Services allow administrators to monitor system performance at a higher level rather than focusing only on individual infrastructure metrics. By associating KPIs, entities, and dependencies with a service, ITSI can calculate an overall service health score that reflects the operational status of the system. Services therefore provide the foundational structure for monitoring and analyzing IT environments within ITSI.
Demand Score: 78
Exam Relevance Score: 89
How is service health calculated in ITSI?
By evaluating KPI severity levels and applying weighting rules.
Service health is determined by analyzing the severity states of KPIs associated with the service. Each KPI contributes to the service health score according to its assigned importance or weighting. When KPI thresholds indicate warning or critical conditions, those severity states influence the overall health score calculation. Administrators can adjust KPI weights to reflect the relative importance of different metrics. For example, a critical application response-time KPI may have greater impact on service health than a minor resource utilization metric.
Demand Score: 76
Exam Relevance Score: 90
What is an important consideration when modeling services in ITSI?
Accurately mapping infrastructure components and dependencies.
Effective service modeling requires identifying the infrastructure components that support each service and defining their relationships. This includes mapping entities such as servers, applications, and network devices to the service as well as defining dependencies between related services. Accurate modeling ensures that KPI evaluations and service health calculations correctly reflect the operational state of the system. Poorly defined service models can lead to misleading health scores or incomplete visibility into service performance.
Demand Score: 70
Exam Relevance Score: 85