Associate metrics data to your asset structure in Splunk IAI

After you set up data ingestion from your industrial assets and uploaded your asset hierarchies, associate your data to your asset hierarchies in Splunk Industrial Asset Intelligence (IAI). Data association makes it possible to browse your assets in a tree structure and see all of their associated metrics and alarm data.

Prerequisites

• You must have metrics data ingested into a metrics index. See Get your metrics and alarms data in to Splunk IAI.
• Your metrics data must match the IoT common information model for metrics data. See Requirements for metrics data from your industrial assets.
• You must have uploaded at least one asset hierarchy. See Model your asset hierarchy in Splunk IAI.

Steps

1. Search to identify the data to associate.
2. Label your data.
3. Match unmatched assets.
4. (Optional) Associate additional data.

Search to identify the data to associate

Run a search for the data that you want to associate to this asset hierarchy. The search generates a table from your indexed metrics data that you can use to identify your assets, metrics, and metric values. If you want to associate alarm data, see Associate alarm data to your asset structure in Splunk Industrial Asset Intelligence.

1. Log in to Splunk Web and access Splunk Industrial Asset Intelligence.
2. Click the Configure gear icon.
3. Click the Asset Hierarchies tab.
4. In the row of the asset hierarchy to which you want to associate data, click Associate Data in the Actions column.
5. Enter this search in the Search field, replacing <your index name> with the name of the index that contains the metrics data that you want to associate with this asset hierarchy:

   |mstats latest(_value) where metric_name=* AND index=<your index name> by asset metric_name index

6. Click the magnifying glass icon to the right of the search field to search your data.

Up to 50 results appear in a table, presenting a sample of the index, assets, metric names, and metric values from your indexed data.

Label your data

Confirm that your metrics data is correctly ingested according to the required schema by labeling the required columns. If you want to label alarm data instead, see Associate alarm data to your asset structure in Splunk Industrial Asset Intelligence.

1. Read the sample values in the asset column and confirm this data represents the names of assets in your environment.
2. Click a row of the asset column.
3. In the drop-down menu that appears, select Assets.
4. Read the sample values in the metric_name column and confirm this data represents the names of metrics, also known as tags or sensors, in your environment.
5. Click a row of the metric_name column.
6. In the drop-down menu that appears, select Metric > Name.
7. Read the sample values in the value column and confirm this data represents the values of metrics in your environment.
8. Click a row of the value column.
9. In the drop-down menu that appears, select Metric > Value.
10. Confirm that the index field is visible.
11. Click Next.

Splunk IAI uses the labels you applied to automatically map the data in your index to your asset hierarchy, matching up the assets in your data that are an exact match to the names of the assets you defined in your hierarchy. If the assets in your data are not an exact match for the names of assets defined in your hierarchy, match the unmatched assets.

Match unmatched assets

In the Match Unmatched Assets screen, Splunk IAI displays a list of assets from your hierarchy in the left column and a list of unmatched assets in your data in the right column. The assets for which Splunk IAI was able to find an exact match are labeled with a green checkmark icon. The remaining assets are labeled with a yellow triangle to indicate they are unmatched.

Match any unmatched assets by creating and uploading a mapping file. A mapping file correlates asset names from your data with asset names in your hierarchy so that Splunk IAI can map the data in your index correctly to your hierarchy.

1. Create a two-column CSV file with this header row: hierarchy,source.
2. In the Match Unmatched Assets screen, use the filters to navigate through the unmapped assets in your hierarchy and sample data to find the ones that you want to match.
3. Populate rows in your CSV file with asset names from your hierarchy and the asset names in your indexed data to which they correlate.

   In the hierarchy column of your CSV file, you must use the full path to the asset, exactly as it appears in the column of assets from your hierarchy.

4. Save the CSV file.
5. Drag and drop the file you want to upload to the Drop your file here area on the page, or click Browse to navigate to the file. When you upload a valid mapping file, the summary of matched and unmatched assets changes to reflect the new mappings you provided in the file.
6. Repeat as needed, using additional mapping files to match any remaining unmatched assets until you have matched all relevant items.
7. Click Save.

Associate additional data

After you associate your data, you can associate additional data to the same asset hierarchy by following the steps on this page again, but modifying the search that you use.

If you have alarm data to associate to the assets in this hierarchy, see Associate alarm data to your asset structure in Splunk IAI.

If you have additional metrics data for the same assets in a different index, associate the data in that index to the same asset hierarchy by using the following search, replacing <your new index name> with the name of the index that contains the metrics data that you want to associate with this asset hierarchy:

|mstats latest(_value) where metric_name=* AND index=<your new index name> by asset metric_name index

If you begin to collect data for an additional metric in the same index, you can associate data for just that metric data point by using the following search, replacing <your new metric name> with the metric_name of the metric data point for which you want to add new data and <your index name> with the name of the index that contains the metrics data that you want to associate with this asset hierarchy:

|mstats latest(<your new metric_name>) where asset=* AND index=<your index name> by asset metric_name index

If you begin to collect data for an additional asset in the same index, you can associate data for just that asset by using the following search:

|mstats latest(_value) where asset= * or "<your new asset name>" AND metric_name=* or <your new metric name> AND index=* or <your index name> by asset metric_name index