Application Performance Management data model reference

The Splunk ITSI Module for Application Performance Monitoring includes a data model. The supported add-ons listed in About the ITSI APM Module apply the tags and search-time field normalizations defined in this model, allowing you to monitor APM data from those technologies without any additional configuration. To integrate data from other application performance monitoring technologies with your Splunk ITSI deployment, use the reference tables on this page to apply the required tags and normalize fields.

Tags used with event objects

These tags act as constraints to identify your events as being relevant to this data model.

Dataset name	Tag constraints	Tags inherited from parent dataset
Inventory	apm, inventory
|____ Application	application	apm, inventory
Performance	apm, performance
|____ Application	application	apm, performance
|____ EUEM	euem	apm, performance

Fields for event datasets

This table lists the extracted and calculated fields for the event datasets in the model. The table does not include any inherited fields.

Dataset name	Field name	Data type	Description	Expected values
Inventory	tag	string	The Splunk platform uses this automatically generated field to access tags from within data models. You do not need to populate it.
Inventory	role	string	A calculated field that defines the role played by the entity.	apm
Application_Information	account	string	Account ID or account name of the customer account registered with the APM vendor.
Application_Information	app_language	string	The language/framework that the application being monitored is written in.
Application_Information	app_name	string	Name of the application being monitored by the APM tool.
Application_Information	app_title	string	Unique identifier for the application being monitored by the APM tool.
Application_Information	application_id	string	The unique ID of the application from the APM vendor.
Application_Information	availability	number	The latest reporting state of the application.	1 (available) or 0 (unavailable)
Application_Information	health	number	The latest health state of application.	1 (normal), 2 (warning), 3 (critical), or 0 (unknown)
Application_Information	vendor	string	Vendor of the APM product.
Performance	app_name	string	Name of the application being monitored by the APM tool.
Performance	app_title	string	Unique identifier for the application being monitored by the APM tool.
Performance	tag	string	The Splunk platform uses this automatically generated field to access tags from within data models. You do not need to populate it.
Application	apdex_score	number	Apdex (Application Performance Index) score for the application. The apdex score defines a standard method for reporting and comparing the performance of software applications with values between 0.0 and 1.0.
Application	availability	number	The latest reporting state of application.	1 (available) or 0 (unavailable)
Application	error_rate	number	The percentage of requests with errors over total requests for the application.
Application	health	number	The latest health state of application.	1 (normal), 2 (warning), 3 (critical), or 0 (unknown)
Application	response_time	number	The time that the application took to respond to a request, in milliseconds.
Application	thruput	number	The count of requests received per minute to the application.
EUEM	response_time	number	The time that the application took to respond to a request as measured from the end user's browser or mobile device, in milliseconds.
EUEM	apdex_score	number	Apdex (Application Performance Index) score for end user monitoring of the application. The apdex score defines a standard method for reporting and comparing the performance of software applications with values between 0.0 and 1.0.
EUEM	thruput	number	The count of requests per minute for the end user monitoring of the application.