What is TrackMe?

TrackMe is a Splunk app that discovers, maintains, and monitors the availability and quality of your data — across one Splunk deployment or many, at any scale.

Think of it as a control plane that sits on top of Splunk. It continuously watches raw index=… activity and turns it into something you can actually operate on: per-entity health states, service-level objectives, stateful alerts, and — optionally — LLM-generated investigations.

TrackMe Virtual Tenants landing page showing tenant cards with entity health counts TrackMe tenant home showing tracked entities and their states

What problem does it solve?

In a large Splunk environment, data silently breaks. A forwarder stops, a sourcetype starts arriving late, a field stops parsing, a scheduled search begins skipping. Splunk itself will not tell you — the searches simply return less, or nothing, and nobody notices until a detection misses or a dashboard goes blank.

TrackMe answers the questions that classic Splunk monitoring leaves open:

  • Is my data still flowing? Every data source, host, and metric feed is tracked for delay, latency, and volume.

  • Is my data still good? Field parsing quality and CIM compliance are monitored, not assumed.

  • Are my searches still healthy? Scheduled-search execution, skipping, and errors are tracked as first-class entities.

  • Is my license volume normal? Every index’s licensed volume is tracked for drops, spikes, inactivity and trend.

  • Who do I tell, and how urgently? Priority, SLA, and impact scoring decide what is worth an alert and what is just noise.

Who is it for?

  • Splunk administrators who need to prove the platform is healthy and catch silent failures before users do.

  • SOC and detection engineers who depend on complete, timely, well-parsed data for their correlation searches.

  • Service owners who report availability and SLA attainment upward.

  • Managed service providers who operate many isolated customer environments from one place.

What can you monitor?

Everything tracked in TrackMe is an entity, and every entity belongs to one of seven monitoring components. The component decides what is measured. Four dedicated tenant types — User Activity Monitoring, Cribl Stream, Cribl Edge and Splunk HEC — raise findings instead of tracking entities (see Findings, Finding groups and findings actions).

Code

Component

What it tracks

DSM

Data Source Monitoring

(index, sourcetype) data feeds — delay, latency, volume, format quality.

DHM

Data Host Monitoring

Host × sourcetype activity — delay, latency, host count.

MHM

Metric Host Monitoring

Hosts sending metric data — metric lag per category.

VOL

Volume Outliers

The licensed volume of every index, read from the license usage logs — ML outliers (drops / spikes), inactivity, daily volume, trend and month projection.

FLX

Flex Objects

Any SPL you write, turned into a tracked entity with custom KPIs and dynamic thresholds.

FQM

Field Quality Monitoring

Field parsing quality and CIM compliance — coverage and success per field.

WLK

Workload Knowledge

Scheduled-search execution health — skip ratio, errors, execution delay.

UAM

User Activity Monitoring

Who is doing what on the platform — the accounts, their scheduled searches, their search activity and resource usage, read from the audit trail and the introspection and raised as findings. A dedicated tenant type rather than an entity component: see User Activity Monitoring.

Cribl Stream

Cribl Stream

The health and traffic of a Cribl Stream deployment — Sources, Destinations, Pipelines, Routes and Workers — read from the Cribl metrics in Splunk and the Cribl Leader API and raised as findings. A dedicated tenant type: see Cribl Stream and Cribl Edge.

Cribl Edge

Cribl Edge

The Fleets of a Cribl Edge Leader, their Edge Nodes and the Sources and Destinations they run — connectivity, rollouts and version drift, health, disk — read from the Leader API at any fleet size and raised as findings. A dedicated tenant type: see Cribl Edge.

Splunk HEC

Splunk HEC

The HTTP Event Collector endpoints of a Splunk deployment, their pools and tokens — availability, refused requests, back pressure, load balancing, rejected data, silent tokens — read from the HEC telemetry Splunk already writes and raised as findings. A dedicated tenant type: see Splunk HEC.

The short version: DSM, DHM, and MHM answer “is the data arriving?”, FQM answers “is it well-formed?”, WLK answers “are my searches healthy?”, VOL answers “is my license volume normal?”, FLX lets you monitor anything else by writing the SPL yourself. Four dedicated findings tenants complete the picture: UAM answers “who is doing what?”, a Cribl Stream tenant answers “is my Cribl pipeline healthy?”, a Cribl Edge tenant answers “is every Edge Node where it should be?” and a Splunk HEC tenant answers “are my HEC endpoints receiving, and who is refused?”.

The seven TrackMe monitoring components and the three dedicated findings tenants, grouped by the question each answers Top row, the seven entity components in five columns: "Is the data arriving?" groups DSM, DHM and MHM; "Is it well-formed?" is FQM; "Are searches healthy?" is WLK; "Is my license volume normal?" is VOL; "Anything else?" is FLX, where you write the SPL. Bottom row, the dedicated findings tenants, which raise findings instead of tracking entities: User Activity Monitoring answers "Who is doing what?", Cribl Stream answers "Is my Cribl pipeline healthy?" and Cribl Edge answers "Is every Edge Node where it should be?". Seven components and three findings tenants — grouped by the question each one answers Is the data arriving? DSM Data Source Monitoring index × sourcetype feeds DHM Data Host Monitoring host × sourcetype activity MHM Metric Host Monitoring hosts sending metric data delay · latency · volume Is it well-formed? FQM Field Quality Monitoring parsing quality & CIM Is every field parsed and CIM-compliant? Coverage & success measured per field. Are searches healthy? WLK Workload Knowledge scheduled-search health Are searches skipping, erroring, or running late? Execution health as first-class entities. Is my license volume normal? VOL Volume Outliers licensed volume per index Is an index dropping, spiking, or going silent? ML outliers, inactivity, trend & month projection. Anything else? FLX Flex Objects any SPL → tracked entity Everything else — you write the SPL; it becomes an entity with custom KPIs & dynamic thresholds. Dedicated findings tenants — one tenant type each: findings and Finding groups, not entities Who is doing what? UAM User Activity Monitoring accounts, searches, knowledge objects Which accounts run what, who owns which schedule or lookup, who eats the search CPU. Is my Cribl pipeline healthy? Cribl Stream Sources, Destinations, Routes, Workers Cribl metrics in Splunk + Leader API Backpressure, traffic outside what each object learned, Workers that drift. Is every Edge Node where it should be? Cribl Edge Fleets, Edge Nodes, Sources & Destinations Leader node directory, any fleet size Disconnected nodes, rollouts and version drift, failing inputs and full disks.

Each component is covered in Part 3 — Monitoring Components.

How TrackMe is built

TrackMe is organised around three layers. You do not need to know the internals to use it, but the shape explains why the product behaves the way it does.

Layer

What it does

Data plane

Scheduled searches (“trackers”) run on a cycle and a shared decision maker computes each entity’s state and score. This is where “is it healthy?” is decided.

Control plane

A REST API and a per-tenant KV Store hold all configuration and current state — the single source of truth.

Presentation

A modern React interface (Virtual Tenants, Tenant Home, dashboards) and an optional AI Assistant.

The mechanics of the cycle are explained in How TrackMe works.

Editions and licensing

TrackMe ships in several editions (Foundation, Enterprise, Unlimited, and trial / developer variants). A new install automatically starts a 90-day Foundation Trial with full functionality. When a license expires, TrackMe enters read-only mode: monitoring keeps running and all data, dashboards, alerts, and history stay visible, but creating or editing configuration is disabled until a license is applied.

See the License page for the full edition matrix and the License registration page to apply one.

See also