FLX — Flex Objects

Flex Objects turn the result of any Splunk search into fully tracked, scored, and alertable entities, with KPIs and thresholds you define. If you can write the search, TrackMe can monitor it. FLX is the most flexible component — and, with a 60+ template catalogue, often the fastest to get value from.

Note

Flex Objects are an Enterprise / Unlimited Edition capability.

The Flex search contract

A Flex tracker is a search whose each result row becomes one entity. TrackMe reads meaning from specific field names in that output:

Field	Required	Meaning
object	yes	The unique entity identifier (any ASCII string).
status	yes	The entity state: 1 green, 2 orange, 3 red, 0 unknown.
group	no	A logical grouping (defaults to the tracker name); an entity should belong to one group.
metrics	no	A JSON object of KPIs — one numeric value per key.
outliers_metrics	no	Per-metric ML outlier rules.
alias, object_description, status_description	no	Display name and human-readable context.
max_sec_inactive, default_metric, default_threshold	no	Inactivity window and default KPI / threshold.

Each metric you emit is stored on the entity and ingested into the metrics index (prefix trackme.splk.flx.), so your KPIs are immediately queryable with mstats for your own dashboards.

Dynamic thresholds

You set per-metric threshold rules (an operator and a value) entirely through the UI — no need to edit the SPL. Thresholds can be time-sliced (day-of-week × hour-of-day) for tighter limits during business hours. An entity’s state is driven by threshold breaches, inactivity, outliers, and metric-shape drift.

The template catalogue

Rather than start from a blank search, load one of 60+ pre-built templates from the Flex Objects Library, organised by vendor and category — Splunk infrastructure, data collection & quality, license management, Splunk Cloud / SVC, SOAR, Cribl, host monitoring, and more. Each template ships a complete search, pre-configured KPIs and outlier rules, a recommended schedule, and inline guidance. Load it, adapt the SPL to your environment, simulate, and create.

Tip

FLX is the most powerful component, and the steepest. Its value depends on the author’s SPL skill — so start from a template whenever one fits. See also the Use Cases for worked examples.

Creating a Flex tracker

1. Name & deployment — local, or a remote account (connectivity is validated).

2. Define the SPL — from a template or from scratch.

3. Time ranges — short (for example -5m for | rest) or longer for tstats / stats.

4. Simulate — preview the discovered entities with their parsed metrics and outliers.

5. Schedule & create.

Outlier detection

FLX is, with DSM, the natural home for ML outlier detection. Per metric you can enable upper/lower breach alerting, with optional seasonality (hour, day-of-week) and a training window. Allow at least a week — ideally a month — of history before relying on outlier alerts. See Machine Learning.

Working at scale

A single tracker can manage from a handful to tens of thousands of entities. Use the group field deliberately to scope thresholds and SLA and to keep large trackers organised — a common convention is object = group + ":" + host. Prefer tstats over raw events and keep time ranges narrow.

Converging trackers

A converging tracker is a Flex flavour that aggregates the up/down state of many member entities — possibly across several tenants and components — into a single object with a percentage-availability KPI (for example “Authentication service: 98.5% available”). It is created from its own wizard, and a searchable inspector lists its members with a link back to each member’s own tenant. Membership scope, the orange-as-up toggle, and the minimum-green percentage are editable in place; the object name and group are fixed once created.

Managing trackers

Warning

Manage a tracker’s lifecycle only through TrackMe — do not manually delete its reports or lookups. Deleting a tracker removes its knowledge objects but does not remove entities it already discovered; those simply stop being maintained. Tune max_sec_inactive so entities that naturally go quiet do not raise false inactivity alerts.

See also

• Flex Object trackers — in depth — the tracker library, search contract, KPI/metrics JSON, the wizard, and high-scale grouping.

• Flex Objects use cases — worked examples.

• Entity State & Scoring — dynamic thresholds and scoring.

• Machine Learning — native outlier detection.

• Hybrid trackers and Replica trackers — advanced tracker types.