Monitoring Components

Everything TrackMe tracks is an entity, and every entity belongs to one of seven monitoring components. The component decides what is measured and which tracking logic applies. This part introduces the shared model, gives each component its own page, then covers the advanced tracker types that extend them.

• Overview — the seven components at a glance, the shared entity lifecycle, and how to choose between them.

• DSM, DHM, MHM — the data-flow family (“is my data arriving?”).

• VOL — is my license volume normal? Drops, spikes and silence on the licensed volume of every index, with a trend and a month projection.

• FLX — track anything you can express in SPL.

• FQM — is my data well-parsed and CIM-compliant?

• WLK — are my scheduled searches healthy?

• UAM — Who is doing what on my Splunk? A dedicated tenant type outside the seven entity components: the accounts, their scheduled searches, their activity and their resource usage, turned into findings.

• Cribl Stream — Is my Cribl Stream deployment healthy? A dedicated tenant type that monitors one Cribl Stream deployment from the Cribl metrics already in Splunk and the Cribl Leader API: Sources, Destinations, Pipelines, Routes and Workers, findings from a policy catalogue and traffic ML models.

• Cribl Edge — Are my Cribl Edge Fleets healthy? A dedicated tenant type that follows the Fleets of a Cribl Edge Leader and their Edge Nodes, Sources and Destinations, read in bulk from the Leader at any fleet size, with findings from a policy catalogue.

• Splunk HEC — Are my HTTP Event Collector endpoints healthy? A dedicated tenant type that monitors the HEC endpoints, pools and tokens of one Splunk deployment from the telemetry Splunk already writes (_introspection and _internal), with findings from a policy catalogue and traffic models.

• Findings — the model the four dedicated tenant types share: policies, findings, Finding groups, notifications, findings actions and the AI Agents.

• Hybrid & replica trackers — advanced tracker types that feed entities into those components: build a tracker from your own SPL (local or remote), or mirror entities from another TrackMe deployment.

• The seven components at a glance
• DSM — Data Source Monitoring
• DHM — Data Host Monitoring
• Feeds thresholds (delay & latency)
• Expected sources & hosts — in depth
• MHM — Metric Host Monitoring
• VOL — Volume Outliers
• Volume Outliers — in depth
• FLX — Flex Objects
• Flex Object trackers — in depth
• FQM — Field Quality Monitoring
• WLK — Workload Knowledge
• Workload monitoring — in depth
• User Activity Monitoring
• User Activity Monitoring — reference
• Findings, Finding groups and findings actions
• Cribl Stream and Cribl Edge
• Splunk HEC
• Splunk HEC reference
• Hybrid trackers
• Hybrid trackers — in depth
• Replica trackers