Alerts

The fields and tags in the Alerts data model describe the alerts produced by alerting systems, such as Nagios or NetCool, for use in Splunk correlation searches or dashboards. They are not to be used to describe Splunk Alerts or Notable Events, which are already modeled in other contexts.

Note: A dataset is a component of a data model. In versions of the Splunk platform prior to version 6.5.0, these were referred to as data model objects.

Tags used with the Alerts event dataset

The following tag acts as constraint to identify your events as being relevant to this data model. For more information, see How to use these reference tables.

Dataset name	Tag name
Alerts	alert

Fields for the Alerts event dataset

The following table lists the extracted and calculated fields for the event dataset in the model. The table does not include any inherited fields. For more information, see How to use these reference tables.

• Recommended are fields derived from the "recommended=true" JSON parameter that the TA developers need to make best efforts to map
• Prescribed fields are the permitted values that can populate the fields, which are derived from the "expected_values" JSON parameter
• Other values are other example values that you might see

Dataset name	Field name	Data type	Description	Abbreviated list of example values
Alerts	app	string	The application involved in the event, such as win:app:trendmicro, vmware, nagios.	recommended
Alerts	body	string	The body of a message.
Alerts	dest	string	The destination of the alert message, such as an email address or SNMP trap. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.	recommended
Alerts	dest_bunit	string	The business unit associated with the destination. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.
Alerts	dest_category	string	The category of the destination. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.
Alerts	dest_priority	string	The priority of the destination. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.
Alerts	id	string	The unique identifier of a message.
Alerts	severity	string	The severity of a message. Note: This field is a string. Please use a severity_id field for severity ID fields that are integer data types. Specific values are required. Please use vendor_severity for the vendor's own human-readable strings (such as Good, Bad, Really Bad, and so on).	prescribed fields: critical, high, medium, low, informational, unknown
Alerts	severity_id	string	A numeric severity indicator for a message.
Alerts	src	string	The source of the message. You can alias this from more specific fields, such as src_host, src_ip, or src_name.
Alerts	src_bunit	string	The business unit associated with the source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.
Alerts	src_category	string	The category of the source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.
Alerts	src_priority	string	The priority of the source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.
Alerts	subject	string	The message subject.
Alerts	tag	string	This automatically generated field is used to access tags from within data models. Do not define extractions for this field when writing add-ons.
Alerts	type	string	The message type.	recommended prescribed fields: alarm, alert, event, task, unknown