admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
UpdateRequiredFields
splunk-security_content/bin/base_datamodels/Performance.json
T

844 lines
24 KiB
JSON
Raw Permalink Blame History

{
"modelName": "Performance",
"displayName": "Performance",
"description": "Performance Data Model",
"editable": false,
"objects": [
{
"comment": {
"ta_relevant": false
},
"objectName": "All_Performance",
"displayName": "All Performance",
"parentName": "BaseEvent",
"fields": [
{
"comment": {
"description": "The business unit of the system where the event occurred. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
"ta_relevant": false
},
"fieldName": "dest_bunit",
"displayName": "dest_bunit",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The category of the system where the event occurred. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
"ta_relevant": false
},
"fieldName": "dest_category",
"displayName": "dest_category",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": true,
"hidden": false
},
{
"comment": {
"description": "The priority of the system where the performance event occurred.",
"ta_relevant": false
},
"fieldName": "dest_priority",
"displayName": "dest_priority",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "Indicates whether or not the system where the performance event occurred should time sync. This field is automatically provided by Asset and Identity correlation features of applications like the Splunk App for Enterprise Security.",
"ta_relevant": false
},
"fieldName": "dest_should_timesync",
"displayName": "dest_should_timesync",
"type": "boolean",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "Indicates whether or not the system where the performance event occurred should update. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
"ta_relevant": false
},
"fieldName": "dest_should_update",
"displayName": "dest_should_update",
"type": "boolean",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The ID of the virtualization hypervisor."
},
"fieldName": "hypervisor_id",
"displayName": "hypervisor_id",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The type of facilities resource involved in the performance event, such as a rack, room, or system."
},
"fieldName": "resource_type",
"displayName": "resource_type",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.",
"ta_relevant": false
},
"fieldName": "tag",
"displayName": "tag",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": true,
"hidden": false
}
],
"calculations": [
{
"calculationID": "All_Performance_fillnull_dest",
"calculationType": "Eval",
"outputFields": [
{
"comment": {
"description": "The system where the event occurred, usually a facilities resource such as a rack or room. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.",
"recommended": true
},
"fieldName": "dest",
"displayName": "dest",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)"
}
],
"constraints": [
{
"search": "(`cim_Performance_indexes`) tag=performance (tag=cpu OR tag=facilities OR tag=memory OR tag=storage OR tag=network OR (tag=os ((tag=time tag=synchronize) OR tag=uptime)))"
}
],
"children": [
]
},
{
"comment": {
"tags": [
"performance",
"cpu"
]
},
"objectName": "CPU",
"displayName": "CPU",
"parentName": "All_Performance",
"fields": [
{
"comment": {
"description": "The amount of CPU load reported by the controller in megahertz."
},
"fieldName": "cpu_load_mhz",
"displayName": "cpu_load_mhz",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The amount of CPU load reported by the controller in percentage points.",
"recommended": true
},
"fieldName": "cpu_load_percent",
"displayName": "cpu_load_percent",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The number of CPU seconds consumed by processes."
},
"fieldName": "cpu_time",
"displayName": "cpu_time",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "Percentage of CPU user time consumed by processes."
},
"fieldName": "cpu_user_percent",
"displayName": "cpu_user_percent",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"calculations": [
],
"constraints": [
{
"search": "tag=cpu"
}
],
"children": [
]
},
{
"comment": {
"tags": [
"performance",
"facilities"
]
},
"objectName": "Facilities",
"displayName": "Facilities",
"parentName": "All_Performance",
"fields": [
{
"comment": {
"description": "Average temperature of the facilities resource, in degrees Celsius.",
"recommended": true
},
"fieldName": "temperature",
"displayName": "temperature",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "Amount of power consumed by the facilities resource, in Kw\/h."
},
"fieldName": "power",
"displayName": "power",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The speed of the cooling fan in the facilities resource, in rotations per second."
},
"fieldName": "fan_speed",
"displayName": "fan_speed",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"calculations": [
],
"constraints": [
{
"search": "tag=facilities"
}
],
"children": [
]
},
{
"comment": {
"tags": [
"performance",
"memory"
]
},
"objectName": "Memory",
"displayName": "Memory",
"parentName": "All_Performance",
"fields": [
{
"comment": {
"description": "The total amount of memory capacity reported by the resource, in megabytes.",
"recommended": true
},
"fieldName": "mem",
"displayName": "mem",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The committed amount of memory reported by the resource, in megabytes."
},
"fieldName": "mem_committed",
"displayName": "mem_committed",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The free amount of memory reported by the resource, in megabytes.",
"recommended": true
},
"fieldName": "mem_free",
"displayName": "mem_free",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The used amount of memory reported by the resource, in megabytes.",
"recommended": true
},
"fieldName": "mem_used",
"displayName": "mem_used",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The total swap space size, in megabytes, if applicable."
},
"fieldName": "swap",
"displayName": "swap",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The free swap space size, in megabytes, if applicable."
},
"fieldName": "swap_free",
"displayName": "swap_free",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The used swap space size, in megabytes, if applicable."
},
"fieldName": "swap_used",
"displayName": "swap_used",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"calculations": [
],
"constraints": [
{
"search": "tag=memory"
}
],
"children": [
]
},
{
"comment": {
"tags": [
"performance",
"storage"
]
},
"objectName": "Storage",
"displayName": "Storage",
"parentName": "All_Performance",
"fields": [
{
"comment": {
"description": "The array that the resource is a member of, if applicable."
},
"fieldName": "array",
"displayName": "array",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "Block size used by the storage resource, in kilobytes."
},
"fieldName": "blocksize",
"displayName": "blocksize",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The cluster that the resource is a member of, if applicable."
},
"fieldName": "cluster",
"displayName": "cluster",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The maximum number of available file descriptors."
},
"fieldName": "fd_max",
"displayName": "fd_max",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The current number of open file descriptors."
},
"fieldName": "fd_used",
"displayName": "fd_used",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The latency reported by the resource, in milliseconds."
},
"fieldName": "latency",
"displayName": "latency",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The mount point of a storage resource."
},
"fieldName": "mount",
"displayName": "mount",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "A generic indicator of hierarchy. For instance, a disk event might include the array id here."
},
"fieldName": "parent",
"displayName": "parent",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "Number of blocks read."
},
"fieldName": "read_blocks",
"displayName": "read_blocks",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The latency of read operations, in milliseconds."
},
"fieldName": "read_latency",
"displayName": "read_latency",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "Number of read operations."
},
"fieldName": "read_ops",
"displayName": "read_ops",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The total amount of storage capacity reported by the resource, in megabytes."
},
"fieldName": "storage",
"displayName": "storage",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The free amount of storage capacity reported by the resource, in megabytes.",
"recommended": true
},
"fieldName": "storage_free",
"displayName": "storage_free",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The percentage of storage capacity reported by the resource that is free.",
"recommended": true
},
"fieldName": "storage_free_percent",
"displayName": "storage_free_percent",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The used amount of storage capacity reported by the resource, in megabytes.",
"recommended": true
},
"fieldName": "storage_used",
"displayName": "storage_used",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The percentage of storage capacity reported by the resource that is used.",
"recommended": true
},
"fieldName": "storage_used_percent",
"displayName": "storage_used_percent",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The number of blocks written by the resource."
},
"fieldName": "write_blocks",
"displayName": "write_blocks",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The latency of write operations, in milliseconds."
},
"fieldName": "write_latency",
"displayName": "write_latency",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The total number of write operations processed by the resource."
},
"fieldName": "write_ops",
"displayName": "write_ops",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"calculations": [
],
"constraints": [
{
"search": "tag=storage"
}
],
"children": [
]
},
{
"comment": {
"tags": [
"performance",
"network"
]
},
"objectName": "Network",
"displayName": "Network",
"parentName": "All_Performance",
"fields": [
{
"comment": {
"description": "The current throughput reported by the service, in bytes.",
"recommended": true
},
"fieldName": "thruput",
"displayName": "thruput",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The maximum possible throughput reported by the service, in bytes."
},
"fieldName": "thruput_max",
"displayName": "thruput_max",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"calculations": [
],
"constraints": [
{
"search": "tag=network"
}
],
"children": [
]
},
{
"comment": {
"tags": [
"performance",
"os"
]
},
"objectName": "OS",
"displayName": "OS",
"parentName": "All_Performance",
"fields": [
{
"comment": {
"description": "The event description signature, if available.",
"recommended": true
},
"fieldName": "signature",
"displayName": "signature",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The unique identifier or event code of the event signature."
},
"fieldName": "signature_id",
"displayName": "signature_id",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"calculations": [
],
"constraints": [
{
"search": "tag=os"
}
],
"children": [
]
},
{
"comment": {
"tags": [
"performance",
"os",
"time",
"synchronize"
]
},
"objectName": "Timesync",
"displayName": "Time Synchronization",
"parentName": "OS",
"fields": [
],
"calculations": [
{
"calculationID": "Timesync_fillnull_action",
"calculationType": "Eval",
"outputFields": [
{
"comment": {
"description": "The result of a time sync event.",
"expected_values": [
"success",
"failure"
],
"recommended": true
},
"fieldName": "action",
"displayName": "action",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"expression": "case(isnotnull(action) AND action!=\"\",action,tag=\"success\",\"success\",tag=\"failure\",\"failure\",1=1,\"unknown\")"
}
],
"constraints": [
{
"search": "tag=time tag=synchronize"
}
],
"children": [
]
},
{
"comment": {
"tags": [
"performance",
"os",
"uptime"
]
},
"objectName": "Uptime",
"displayName": "System Uptime",
"parentName": "OS",
"fields": [
],
"calculations": [
{
"calculationID": "Uptime_fillnull_uptime",
"calculationType": "Eval",
"outputFields": [
{
"comment": {
"description": "The uptime of the compute resource, in seconds.",
"recommended": true
},
"fieldName": "uptime",
"displayName": "uptime",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"expression": "if(isnull(uptime) OR uptime=\"\",\"unknown\",uptime)"
}
],
"constraints": [
{
"search": "tag=uptime"
}
],
"children": [
]
}
]
}
Reference in New Issue View Git Blame Copy Permalink