Splunk® Common Information Model Add-on

Common Information Model Add-on Manual

This documentation does not apply to the most recent version of Splunk® Common Information Model Add-on. For documentation on the most recent version, go to the latest release.

Ticket Management

The fields and tags in the Ticket Management data model and event category describe service requests and their states in ITIL-influenced service desks, bug trackers, simple ticket systems, or GRC systems. They can help you establish a domain’s data requirements so you can create apps that support each other.

Tags used with Ticket Management event objects

Object name Tag name
All_Ticket_Management ticketing
|____Incident
incident
|____Problem
problem
|____Change
change

Fields for Ticket Management event objects

Object name Field name Data type Description Possible values
All_Ticket_Management affect_dest string Destinations affected by the service request.
All_Ticket_Management comments string Comments about the service request.
All_Ticket_Management description string The description of the service request.
All_Ticket_Management dest string The destination of the service request. May be aliased from more specific fields, such as dest_host, dest_ip, or dest_name.
All_Ticket_Management priority string The relative priority of the service request.
All_Ticket_Management severity string The relative severity of the service request.
All_Ticket_Management src_user string The user or entity that triggered or created the service request, if applicable.
All_Ticket_Management status string The relative status of the service request.
All_Ticket_Management tag string A tag for the service request.
All_Ticket_Management ticket_id string An identification name, code, or number for the service request.
All_Ticket_Management time_submitted string The time that the src_user submitted the service request.
All_Ticket_Management user string The name of the user or entity that is assigned to carry out the service request, if applicable.
Incident incident string The incident that triggered the service request. Can be a rare occurrence, or something that happens more frequently An incident that occurs on a frequent basis can also be classified as a problem.
Problem problem string When multiple occurrences of related incidents are observed, they are collectively designated with a single problem value. Problem management differs from the process of managing an isolated incident. Often problems are managed by a specific set of staff and through a problem management process.
Change change string Designation for a request for change (RFC) that is raised to modify an IT service to resolve an incident or problem.
Last modified on 04 December, 2014
Splunk Audit Logs   Updates

This documentation applies to the following versions of Splunk® Common Information Model Add-on: 4.0.0


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters