What is TrackMe?

TrackMe is a Splunk app that discovers, maintains, and monitors the availability and quality of your data — across one Splunk deployment or many, at any scale.

Think of it as a control plane that sits on top of Splunk. It continuously watches raw index=… activity and turns it into something you can actually operate on: per-entity health states, service-level objectives, stateful alerts, and — optionally — LLM-generated investigations.

TrackMe Virtual Tenants landing page showing tenant cards with entity health counts TrackMe tenant home showing tracked entities and their states

What problem does it solve?

In a large Splunk environment, data silently breaks. A forwarder stops, a sourcetype starts arriving late, a field stops parsing, a scheduled search begins skipping. Splunk itself will not tell you — the searches simply return less, or nothing, and nobody notices until a detection misses or a dashboard goes blank.

TrackMe answers the questions that classic Splunk monitoring leaves open:

  • Is my data still flowing? Every data source, host, and metric feed is tracked for delay, latency, and volume.

  • Is my data still good? Field parsing quality and CIM compliance are monitored, not assumed.

  • Are my searches still healthy? Scheduled-search execution, skipping, and errors are tracked as first-class entities.

  • Who do I tell, and how urgently? Priority, SLA, and impact scoring decide what is worth an alert and what is just noise.

Who is it for?

  • Splunk administrators who need to prove the platform is healthy and catch silent failures before users do.

  • SOC and detection engineers who depend on complete, timely, well-parsed data for their correlation searches.

  • Service owners who report availability and SLA attainment upward.

  • Managed service providers who operate many isolated customer environments from one place.

What can you monitor?

Everything tracked in TrackMe is an entity, and every entity belongs to one of six monitoring components. The component decides what is measured.

Code

Component

What it tracks

DSM

Data Source Monitoring

(index, sourcetype) data feeds — delay, latency, volume, format quality.

DHM

Data Host Monitoring

Host × sourcetype activity — delay, latency, host count.

MHM

Metric Host Monitoring

Hosts sending metric data — metric lag per category.

FLX

Flex Objects

Any SPL you write, turned into a tracked entity with custom KPIs and dynamic thresholds.

FQM

Field Quality Monitoring

Field parsing quality and CIM compliance — coverage and success per field.

WLK

Workload Knowledge

Scheduled-search execution health — skip ratio, errors, execution delay.

The short version: DSM, DHM, and MHM answer “is the data arriving?”, FQM answers “is it well-formed?”, WLK answers “are my searches healthy?”, and FLX lets you monitor anything else by writing the SPL yourself.

The six TrackMe monitoring components grouped by the question each answers Four columns. "Is the data arriving?" groups DSM, DHM and MHM. "Is it well-formed?" is FQM. "Are searches healthy?" is WLK. "Anything else?" is FLX — you write the SPL. Six components — grouped by the question each one answers Is the data arriving? DSM Data Source Monitoring index × sourcetype feeds DHM Data Host Monitoring host × sourcetype activity MHM Metric Host Monitoring hosts sending metric data delay · latency · volume Is it well-formed? FQM Field Quality Monitoring parsing quality & CIM Is every field parsed and CIM-compliant? Coverage & success measured per field. Are searches healthy? WLK Workload Knowledge scheduled-search health Are searches skipping, erroring, or running late? Execution health as first-class entities. Anything else? FLX Flex Objects any SPL → tracked entity Everything else — you write the SPL; it becomes an entity with custom KPIs & dynamic thresholds.

Each component is covered in Part 3 — Monitoring Components.

How TrackMe is built

TrackMe is organised around three layers. You do not need to know the internals to use it, but the shape explains why the product behaves the way it does.

Layer

What it does

Data plane

Scheduled searches (“trackers”) run on a cycle and a shared decision maker computes each entity’s state and score. This is where “is it healthy?” is decided.

Control plane

A REST API and a per-tenant KV Store hold all configuration and current state — the single source of truth.

Presentation

A modern React interface (Virtual Tenants, Tenant Home, dashboards) and an optional AI Assistant.

The mechanics of the cycle are explained in How TrackMe works.

Editions and licensing

TrackMe ships in several editions (Foundation, Enterprise, Unlimited, and trial / developer variants). A new install automatically starts a 90-day Foundation Trial with full functionality. When a license expires, TrackMe enters read-only mode: monitoring keeps running and all data, dashboards, alerts, and history stay visible, but creating or editing configuration is disabled until a license is applied.

See the License page for the full edition matrix and the License registration page to apply one.

See also