Hybrid trackers¶

A hybrid tracker is a scheduled tracker, created and lifecycle-managed by TrackMe, that runs alongside a component’s default tracker. It can discover and manage entities and/or run a custom SPL check that contributes an extra signal — built from your own SPL, run locally or against a remote Splunk. Hybrid trackers are available for every component (DSM, DHM, MHM, FLX, FQM, WLK).

Note

This is one of the two advanced tracker types. To mirror entities from another TrackMe instance rather than build a signal from SPL, see Replica trackers.

When to use one¶

The default tracker cannot reach the data — run the check against a remote Splunk via a configured remote account (see Integrations & Remote Deployments).
You have high-cardinality or custom break-by entity sets that do not fit a single dynamic threshold.
You want to combine the standard component logic with an extra per-entity signal (for example a CMDB lookup, or a remote row count).

Contribution modes¶

What a hybrid does with its result is the contribution mode:

Mode	Effect
score	Add a fixed score when the result breaches a threshold (composes cleanly with TrackMe scoring). The most common mode.
state	Force the entity’s state directly, overriding the default evaluator.
anomaly_reason	Append to the entity’s anomaly reason without changing state or score.
enrichment	Decorate the entity record with extra fields for the UI and downstream consumers.

Each hybrid runs on its own schedule; the UI shows its cron, last run, and last result. Manage them through the wizards or REST — do not edit the generated saved searches directly.

Note

Keep a hybrid’s query runtime well under its schedule interval, or runs will overlap themselves.
Hybrid-tracker availability depends on edition: Foundation does not support them, Enterprise caps the number per tenant, and Unlimited is uncapped.
A remote account’s own RBAC must permit the caller — that is separate from the edition limits.