A KPI (Key Performance Indicator) is a metric that measures a specific aspect of a service. Examples include response time, error rate, CPU utilization, or transaction volume. Each KPI is backed by a Base Search — a scheduled Splunk search that computes the KPI value.
Base searches are critical for performance. Multiple KPIs can share the same base search to reduce load. For example, one base search might calculate both average response time and error count from the same web server logs. ITSI calls this "shared base searches" and it is a key optimization technique.