Splunk® IT Service Intelligence


Acrobat logo Download manual as PDF

Splunk IT Service Intelligence (ITSI) version 4.12.x will reach its End of Life on January 20, 2024. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see Before you upgrade IT Service Intelligence.
Acrobat logo Download topic as PDF

Database Module data model reference table

Use the below tables as a reference for the data models of this module. The tables contain a breakdown of the required tags for the event objects or searches in that model, and a listing of all extracted and calculated fields included in the model. Data models can be edited by navigating to Settings > Data models

For information on how to map your data to the data models available in the Splunk IT Service Intelligence Modules, see the below links:

Tags used with event objects

The following tags act as constraints to identify your events as being relevant to this data model.

Object name Tag name
Inventory database, inventory

Fields for Database event objects

The following table lists the extracted and calculated fields for the event objects in the model. Note that it does not include any inherited fields.

Object name Field name Data type Description
Inventory availability string The current availability of the database
Inventory character_set string The character set used by the database instance
Inventory collation string The collation used by the database instance
Inventory database_instance string The database instance name
Inventory description string The description of the database instance
Inventory port string The port of the database product
Inventory storage_engine string The underlying storage engine for the database product
Inventory tag string The tag name for the database product
Inventory vendor string The database vendor name
Inventory vendor_product string The database product name
Inventory version string The database product version
Inventory instance_role string The calculated field eval for database_instance
Object name Tag name
Performance database, performance
|____ Table
|____ User
|____ Session
|____ Query
Object name Field name Data type Description
Performance active_transactions number The number of active transactions - per instance
Performance availability string The availability of the database instances or server
Performance connection_pool_used_percent number The percentage of pooled connections in use
Performance connection_pool_wait_time number The wait time for pooled connections that are currently in use
Performance connections number The number of current connections - per instance
Performance current_size number The size of the database - per instance
Performance database_instance string The database instance name
Performance database_name string The database name
Performance deadlock_rate number The number of deadlocks per second - per server
Performance disk_flush_rate number The number of pages written to disk per second
Performance error_rate number The number of database errors per second
Performance instance_read_iops number The number of reads per second - per instance
Performance instance_write_iops number The number of writes per second - per instance
Performance lock_average_wait_time number The average lock wait time, in seconds - per instance
Performance read_lock_rate number The number of read locks acquired per second - per instance
Performance replication_latency number The time it took for a replication event to complete
Performance replication_status string The replication status between database instances or servers
Performance tag string The database server tag name
Performance total_operations_count number The number of CRUD operations - per instance
Performance transaction_rate number The number of transactions the user has performed on the database
Performance write_lock_rate number The number of write locks acquired per second - per instance
Table last_update_time string The last update time for the table
Table row_count number The name of rows in the table
Table size number The size of the table
Table table_name string The name of the table
User transaction_count number The number of transactions the user has performed on the database
User user_id string The user ID in the database
User user_name string The user name in the database
Session buffer_cache_hit_ratio number The percentage of logical reads from the buffer during the session
Session buffer_cache_usage_percent number The percent of buffer cache in use
Session session_id string The unique session identifier
Session session_status string The current session status
Query indexes_hit string list The list of indexes affected by the query
Query query string The actual database query
Query query_id string The database query identifier
Query query_type string The database query type
Query records_affected number The number of records affected by the query
Query response_time number The response time for the query
Query stored_procedures_called string list The list of stored procedures called by the query
Query tables_hit string list The list of tables affected by the query
Query user string The user name in the database
Last modified on 28 April, 2023
Learn more about the Database Module
Database Module troubleshooting

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.9.0, 4.9.1, 4.9.2, 4.9.3, 4.9.4, 4.9.5, 4.9.6, 4.10.0 Cloud only, 4.10.1 Cloud only, 4.10.2 Cloud only, 4.10.3 Cloud only, 4.10.4 Cloud only, 4.11.0, 4.11.1, 4.11.2, 4.11.3, 4.11.4, 4.11.5, 4.11.6, 4.12.0 Cloud only, 4.12.1 Cloud only, 4.12.2 Cloud only, 4.13.0, 4.13.1, 4.13.2, 4.13.3, 4.14.0 Cloud only, 4.14.1 Cloud only, 4.14.2 Cloud only, 4.15.0, 4.15.1, 4.15.2, 4.15.3, 4.16.0 Cloud only, 4.17.0, 4.17.1

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters