Performance
The fields in the Performance data model describe performance tracking data.
Note: A dataset is a component of a data model. In versions of the Splunk platform prior to version 6.5.0, these were referred to as data model objects.
Tags used with Performance event datasets
The following tags act as constraints to identify your events as being relevant to this data model. For more information, see How to use these reference tables.
Dataset name | Tag name |
---|---|
All_Performance | performance |
cpu OR facilities OR memory OR storage OR network OR (os, (uptime OR (time, synchronize))) | |
|
cpu |
|
facilities |
|
memory |
|
storage |
|
network |
|
os |
|
uptime |
|
time |
synchronize |
Fields for Performance event datasets
The following table lists the extracted and calculated fields for the event datasets in the model. The table does not include any inherited fields. For more information, see How to use these reference tables.
The key for using the column titled "Notes" or "Abbreviated list of example values" is as follows:
- Recommended: Add-on developers make their best effort attempts to map these event fields. If these fields are not populated, then the event is not very useful.
- Required: Add-on developers must map these event fields when using the pytest-splunk-addon to test for CIM compatibility. See pytest-splunk-addon documentation.
- Prescribed values: Permitted values that can populate the fields, which Splunk is using for a particular purpose. Other valid values exist, but Splunk is not relying on them.
- Other values: Other example values that you might see.
Object name | Field name | Data type | Description | Abbreviated list of example values |
---|---|---|---|---|
All_Performance | dest
|
string | The system where the event occurred, usually a facilities resource such as a rack or room. You can alias this from more specific fields in your event data, such as dest_host , dest_ip , or dest_name .
|
recommended |
All_Performance | dest_bunit
|
string | The business unit of the system where the event occurred. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons. |
|
All_Performance | dest_category
|
string | The category of the system where the event occurred. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons. |
|
All_Performance | dest_priority
|
string | The priority of the system where the performance event occurred. | |
All_Performance | dest_should_timesync
|
boolean | Indicates whether or not the system where the performance event occurred should time sync. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons. |
|
All_Performance | dest_should_update
|
boolean | Indicates whether or not the system where the performance event occurred should update. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons. |
|
All_Performance | hypervisor_id
|
string | The ID of the virtualization hypervisor. | |
All_Performance | resource_type
|
string | The type of facilities resource involved in the performance event, such as a rack , room , or system .
|
|
All_Performance | tag
|
string | This automatically generated field is used to access tags from within data models. Do not define extractions for this field when writing add-ons. | |
CPU | cpu_load_mhz
|
number | The amount of CPU load reported by the controller in megahertz. | |
CPU | cpu_load_percent
|
number | The amount of CPU load reported by the controller in percentage points. | recommended |
CPU | cpu_time
|
number | The number of CPU seconds consumed by processes. | |
CPU | cpu_user_percent
|
number | Percentage of CPU user time consumed by processes. | |
Facilities | fan_speed
|
number | The speed of the cooling fan in the facilities resource, in rotations per second. | |
Facilities | power
|
number | Rate at which power is consumed by the facilities resource, in kW. | |
Facilities | temperature
|
number | Average temperature of the facilities resource, in °C. | recommended |
Memory | mem
|
number | The total amount of memory capacity reported by the resource, in megabytes. | recommended |
Memory | mem_committed
|
number | The committed amount of memory reported by the resource, in megabytes. | |
Memory | mem_free
|
number | The free amount of memory reported by the resource, in megabytes. | recommended |
Memory | mem_used
|
number | The used amount of memory reported by the resource, in megabytes. | recommended |
Memory | swap
|
number | The total swap space size, in megabytes, if applicable. | |
Memory | swap_free
|
number | The free swap space size, in megabytes, if applicable. | |
Memory | swap_used
|
number | The used swap space size, in megabytes, if applicable. | |
Storage | array
|
number | The array that the resource is a member of, if applicable. | |
Storage | blocksize
|
number | Block size used by the storage resource, in kilobytes. | |
Storage | cluster
|
string | The cluster that the resource is a member of, if applicable. | |
Storage | fd_max
|
number | The maximum number of available file descriptors. | |
Storage | fd_used
|
number | The current number of open file descriptors. | |
Storage | latency
|
number | The latency reported by the resource, in milliseconds. | |
Storage | mount
|
string | The mount point of a storage resource. | |
Storage | parent
|
string | A generic indicator of hierarchy. For instance, a disk event might include the array ID here. | |
Storage | read_blocks
|
number | Number of blocks read. | |
Storage | read_latency
|
number | The latency of read operations, in milliseconds. | |
Storage | read_ops
|
number | Number of read operations. | |
Storage | storage
|
number | The total amount of storage capacity reported by the resource, in megabytes. | |
Storage | storage_free
|
number | The free amount of storage capacity reported by the resource, in megabytes. | recommended |
Storage | storage_free_percent
|
number | The percentage of storage capacity reported by the resource that is free. | recommended |
Storage | storage_used
|
number | The used amount of storage capacity reported by the resource, in megabytes. | recommended |
Storage | storage_used_percent
|
number | The percentage of storage capacity reported by the resource that is used. | recommended |
Storage | write_blocks
|
number | The number of blocks written by the resource. | |
Storage | write_latency
|
number | The latency of write operations, in milliseconds. | |
Storage | write_ops
|
number | The total number of write operations processed by the resource. | |
Network | thruput
|
number | The current throughput reported by the service, in bytes. | recommended |
Network | thruput_max
|
number | The maximum possible throughput reported by the service, in bytes. | |
OS | signature
|
string | The event description signature, if available. | recommended |
OS | signature_id
|
string | The unique identifier or event code of the event signature. | |
Timesync | action
|
string | The result of a time sync event. |
|
Uptime | uptime
|
number | The uptime of the compute resource, in seconds. | recommended |
Network Traffic | Splunk Audit Logs |
This documentation applies to the following versions of Splunk® Common Information Model Add-on: 5.0.1, 5.0.2, 5.1.0, 5.1.1, 5.1.2, 5.2.0, 5.3.1, 5.3.2
Feedback submitted, thanks!