Lagging classes¶

A lagging class is a rule that sets delay (and optionally latency) thresholds for every entity that matches it — the scalable way to manage thresholds without touching entities one by one. Define a class once for “all firewall syslog feeds” or “everything in the sec_* indexes”, and matching entities pick up its thresholds automatically.

Lagging classes are per component: DSM, DHM and MHM each keep their own set (MHM matches on metric category rather than delay/latency). This page covers the splk-feeds (DSM/DHM) classes.

How a lagging class is defined¶

Each class is a matching rule plus the thresholds to apply:

Field	Meaning
name	The pattern to match against (an index name, a sourcetype, or a priority value).
level	What the pattern matches on: `index`, `sourcetype`, or `priority`.
match mode	How the pattern is compared: `exact`, `wildcard`, or `regex` (regex is a full match).
delay	The delay threshold to apply — either a single static value, or a full variable schedule (named time slots, see Variable delay).
latency (optional)	An optional latency (lag) override; leave it empty to not touch latency.

So a single class can apply a static delay, a time-aware variable delay, and/or a latency override, to any set of entities you can describe by index, sourcetype or priority.

How a class is matched to an entity¶

When several classes could apply, TrackMe resolves a single winner deterministically:

By level, most specific first: an index match beats a sourcetype match, which beats a priority match. The first level with any match wins.
Within a level, the most specific match mode wins — exact over wildcard over regex — with the oldest rule breaking any tie.
For multi-value entity fields (common in DHM), a class matches if any value matches.

You can preview which entities a class would match with the lagging-class simulation before saving it.

Note

An entity whose threshold is locked (see Who manages a threshold: the Threshold Lock and the AI Advisor) is skipped by lagging classes entirely — its manual value stands. Likewise, latency rules from a class apply independently of the delay policy, so an entity on variable delay still honours a class’s latency override.

Example: a class for a firewall sourcetype¶

Here we define a class at the sourcetype level for netscreen-firewall, applying a delay of 2 hours (7200 s) and a latency of 10 minutes (600 s). Once the trackers have run at least once and the matching entities are active, their thresholds are set from the class automatically.