Update Instructions

Author: derkkila

content/en/ninja-workshops/12-alerting_monitoring_with_itsi/1-getting-started/1-access-cloud-instances.md

@@ -14,4 +14,4 @@ The Workshop is titled **"Tech Summit 2025: OBS-122"** or you can go directly to
 
 # Splunk Observability Cloud Access
 
-Creating an alert in Observability Cloud should be done in the Observability Cloud **Show Playground** Org.
+Creating an alert in Observability Cloud should be done in the Observability Cloud US1 [Show Playground](https://app.us1.signalfx.com/#/home) Org.

content/en/ninja-workshops/12-alerting_monitoring_with_itsi/2-creating-basic-alerts/_index.md

@@ -21,22 +21,23 @@ Splunk alerts are triggered by search results that match specific criteria. We'l
    ```splunk
    index=main "Invalid user"
    ```
-    Use the time picker to select "Relative" and set the timespan to 10.
+    Use the time picker to select "Last 15 minutes"".
 
 2. **Configure the Alert:**
    * Click "Save As" and select "Alert."
    * Give your alert a descriptive name (e.g., "Numerous Invalid User Logins Attempted").
-   * **Trigger Condition:**
-      * **Scheduled:** Choose "Scheduled" to evaluate the search on a set schedule. Below scheduled will be the button to select the frequency, select "Run on Cron Schedule". If the time Range below that is different than 10 minutes, update it.
+   * **Alert type:**
+      * **Scheduled:** Choose "Scheduled" to evaluate the search on a set schedule. Below scheduled will be the button to select the frequency, select "Run on Cron Schedule". 
+      * **Cron Expression:** */15 * * * *
       * **Triggered when:** Select "Number of results" "is greater than" "100."
-      * **Time Range:** Set to "5 minutes."
+      * **Time Range:** Set to "15 minutes."
    * **Trigger Actions:**
       * For this basic example, choose "Add to Triggered Alerts."  In a real-world scenario, you'd configure email notifications, Slack integrations, or other actions.
    * **Save:** Save the alert.
 
 ![show-entry](../images/save_as_alert.png?classes=inline)
 
-**Explanation:** This alert runs the search every 10 minutes and triggers if the search returns more than 100 results. The "Add to Triggered Alerts" action simply adds a Alert to the Splunk Triggered Alerts list.
+**Explanation:** This alert runs the search every 15 minutes and triggers if the search returns more than 100 results. The "Add to Triggered Alerts" action simply adds a Alert to the Splunk Triggered Alerts list.
 
 **Time Ranges and Frequency:** Since everything in Splunk core is a search, you need to consider the search timespan and frequency so that you are not a) searching the same data multiple times with an overlap timespan, b) missing events because of a gap between timespan and frequency, c) running too frequently and adding overhead or d) running too infrequently and experiencing delays in alerting.
 
@@ -62,11 +63,11 @@ Splunk alerts are triggered by search results that match specific criteria. We'l
 
 **2. Create a Detector:**
    * Click "Detectors & SLOs" in the lefthand menu
-   * Click "Create Detector."
-   * Give the detector a descriptive name (e.g., "High CPU Utilization Alert").
+   * Click "Create Detector -> Custom Detector"
+   * Give the detector a descriptive name (e.g., "High CPU Utilization Alert - INITIALS").
    * **Signal:**
-      * Select the metric you want to monitor (e.g., "cpu.utilization").  Use the metric finder to locate the correct metric.
-      * Add any necessary filters to specify the host (e.g., `service.name:otelshop-loadgenerator`).
+      * Select the metric you want to monitor ("cpu.utilization"). 
+      * Add any necessary filters to specify the host (`service.name:otelshop-loadgenerator`).
    * **Condition:**
       * Set the threshold: "is above" "90" "%."
       * Configure the evaluation frequency and the "for" duration (how long the condition must be true before the alert triggers).

content/en/ninja-workshops/12-alerting_monitoring_with_itsi/3-creating-services-in-itsi/_index.md

@@ -1,5 +1,5 @@
 ---
-title: Creating Basic Alerts
+title: Creating Services in ITSI
 linkTitle: 3. Creating Services in ITSI
 weight: 1
 ---
@@ -14,39 +14,5 @@ We have two existing services: "Online-Boutique-US" (representing an application
 
 ![show-entry](../images/service_tree_start.png?classes=inline)
 
-## Starting with an Observability Cloud Based Service
+**Return to your Splunk Environment and under Apps, select IT Service Intelligence**
 
-1. **Access Services:** In ITSI click "Configuration", click on "Services".
-
-2. **Create New Service: PaymentService2:** Click "Create New Service".
-
-3. **Service Details (PaymentService2):**
-    * **Title:** "PaymentService2"
-    * **Description (Optional):**  e.g., "Payment Service for Hipster Shop - version 2"
-
-4. **Select Template:** Choose "Link service to a service template" and search for "Splunk APM Business Workflow KPIs" from the template dropdown. Click **Create** to save the new service.
-
-6. **Entity Assignment:**
-    * The page will load and display the new Service and you will be on the Entities page. This demo defaults to selecting the *paymentservice:grpc.hipstershop.PaymentService/Charge* entity. In a real world situation you would need to match the workflow to the entity name manually.
-    * **Direct Entity Selection (If Available):** Search for the entity using `sf_workflow="paymentservice:grpc.hipstershop.PaymentService/Charge"` and select it.
-
-7. **Save Service (PaymentService2):** Click "Save" to create "PaymentService2".
-
-## Setting PaymentService2's Service Health as a Dependency for Online-Boutique-US
-
-1. **Locate Online-Boutique-US:** Find the "Online-Boutique-US" service in the service list.
-
-2. **Edit Online-Boutique-US:** Click "Edit".
-
-3. **Service Dependencies:** Look for the "Service Dependencies" section. 
-
-4. **Add Dependency:**  There should be an option to add a dependent service.  Search for "PaymentService2".
-
-5. **Select KPI:** Check the box next to ServiceHealthScore for PaymentService2.
-
-6. **Save Changes:** Save the changes to the "Online-Boutique-US" service.
-
-## Verification
-
-* Verify "PaymentService2" is created and linked to the correct entity.
-* Verify "Online-Boutique-US" now has "PaymentService2" (specifically its Service Health Score) as a dependency.  Changes in the health of "PaymentService2" should now impact the health of "Online-Boutique-US."