Elastic sources¶

Elastic sources turn an arbitrary SPL search into a tracked DSM entity. Instead of discovering entities from straightforward index / sourcetype pairs, you write the search that defines what to monitor — tstats, raw, mstats, or from a data model or lookup — and TrackMe tracks its delay, latency and volume like any other feed. One search defines one entity.

They are the right tool when the thing you want to watch is not a plain feed: a syslog collector keyed by a search-time field, a data-model- or lookup-derived source, or any case that relies on fields only resolved at search time.

Two flavours¶

Kind	Behaviour
Shared	Many elastic entities are evaluated by a single, pooled, concurrency-capped tracker — efficient when you have many lightweight virtual entities.
Dedicated	Each entity is backed by its own independent scheduled report — use when an entity needs its own cadence or a heavier search.

Both can run against a local or a remote Splunk deployment (see Remote Splunk deployments).

Note

For high-cardinality discovery, Hybrid trackers have largely superseded elastic sources — and for monitoring lookups specifically, the dedicated Lookups monitoring add-on replaces the old elastic-source lookup example. Elastic sources remain the right tool for from / raw single-entity edge cases that depend on search-time fields.