Database Module data model reference table
Use the below tables as a reference for the data models of this module. The tables contain a breakdown of the required tags for the event objects or searches in that model, and a listing of all extracted and calculated fields included in the model. Data models can be edited by navigating to Settings > Data models
For information on how to map your data to the data models available in the Splunk IT Service Intelligence Modules, see the below links:
- How to use these reference tables in the Common Information Model Add-on Manual.
- About data models in the Splunk Enterprise Knowledge Manager Manual.
Tags used with event objects
The following tags act as constraints to identify your events as being relevant to this data model.
Object name | Tag name |
---|---|
Inventory | database, inventory |
Fields for Database event objects
The following table lists the extracted and calculated fields for the event objects in the model. Note that it does not include any inherited fields.
Object name | Field name | Data type | Description |
---|---|---|---|
Inventory | availability
|
string | The current availability of the database |
Inventory | character_set
|
string | The character set used by the database instance |
Inventory | collation
|
string | The collation used by the database instance |
Inventory | database_instance
|
string | The database instance name |
Inventory | description
|
string | The description of the database instance |
Inventory | port
|
string | The port of the database product |
Inventory | storage_engine
|
string | The underlying storage engine for the database product |
Inventory | tag
|
string | The tag name for the database product |
Inventory | vendor
|
string | The database vendor name |
Inventory | vendor_product
|
string | The database product name |
Inventory | version
|
string | The database product version |
Inventory | instance_role
|
string | The calculated field eval for database_instance |
Object name | Tag name |
---|---|
Performance | database, performance |
|
table |
|
user |
|
session |
|
query |
Object name | Field name | Data type | Description |
---|---|---|---|
Performance | active_transactions
|
number | The number of active transactions - per instance |
Performance | availability
|
string | The availability of the database instances or server |
Performance | connection_pool_used_percent
|
number | The percentage of pooled connections in use |
Performance | connection_pool_wait_time
|
number | The wait time for pooled connections that are currently in use |
Performance | connections
|
number | The number of current connections - per instance |
Performance | current_size
|
number | The size of the database - per instance |
Performance | database_instance
|
string | The database instance name |
Performance | database_name
|
string | The database name |
Performance | deadlock_rate
|
number | The number of deadlocks per second - per server |
Performance | disk_flush_rate
|
number | The number of pages written to disk per second |
Performance | error_rate
|
number | The number of database errors per second |
Performance | instance_read_iops
|
number | The number of reads per second - per instance |
Performance | instance_write_iops
|
number | The number of writes per second - per instance |
Performance | lock_average_wait_time
|
number | The average lock wait time, in seconds - per instance |
Performance | read_lock_rate
|
number | The number of read locks acquired per second - per instance |
Performance | replication_latency
|
number | The time it took for a replication event to complete |
Performance | replication_status
|
string | The replication status between database instances or servers |
Performance | tag
|
string | The database server tag name |
Performance | total_operations_count
|
number | The number of CRUD operations - per instance |
Performance | transaction_rate
|
number | The number of transactions the user has performed on the database |
Performance | write_lock_rate
|
number | The number of write locks acquired per second - per instance |
Table | last_update_time
|
string | The last update time for the table |
Table | row_count
|
number | The name of rows in the table |
Table | size
|
number | The size of the table |
Table | table_name
|
string | The name of the table |
User | transaction_count
|
number | The number of transactions the user has performed on the database |
User | user_id
|
string | The user ID in the database |
User | user_name
|
string | The user name in the database |
Session | buffer_cache_hit_ratio
|
number | The percentage of logical reads from the buffer during the session |
Session | buffer_cache_usage_percent
|
number | The percent of buffer cache in use |
Session | session_id
|
string | The unique session identifier |
Session | session_status
|
string | The current session status |
Query | indexes_hit
|
string list | The list of indexes affected by the query |
Query | query
|
string | The actual database query |
Query | query_id
|
string | The database query identifier |
Query | query_type
|
string | The database query type |
Query | records_affected
|
number | The number of records affected by the query |
Query | response_time
|
number | The response time for the query |
Query | stored_procedures_called
|
string list | The list of stored procedures called by the query |
Query | tables_hit
|
string list | The list of tables affected by the query |
Query | user
|
string | The user name in the database |
Learn more about the Database Module | Database Module troubleshooting |
This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.11.0, 4.11.1, 4.11.2, 4.11.3, 4.11.4, 4.11.5, 4.11.6, 4.12.0 Cloud only, 4.12.1 Cloud only, 4.12.2 Cloud only, 4.13.0, 4.13.1, 4.13.2, 4.13.3, 4.14.0 Cloud only, 4.14.1 Cloud only, 4.14.2 Cloud only, 4.15.0, 4.15.1, 4.15.2, 4.15.3, 4.16.0 Cloud only, 4.17.0, 4.17.1, 4.18.0, 4.18.1
Feedback submitted, thanks!