Events & sourcetypes¶

TrackMe produces its own data — events, metrics, and logs — as it runs. Knowing what it writes, and where, is the key to troubleshooting and to building your own reports on top of TrackMe.

Indexes¶

Each tenant writes to four configurable index roles (the defaults are shown):

Role	Default	Holds
Summary	`trackme_summary`	Per-entity summary events.
Audit	`trackme_audit`	Audit events (including Configuration Guardian).
Metrics	`trackme_metrics`	The metric store (must be a `metric` index).
Notable	`trackme_notable`	Notable events.

Because indexes are configurable per tenant, do not assume the default names when troubleshooting — check the tenant’s index settings.

Setting the default indexes¶

The deployment-wide defaults — the four index roles plus the index global search filter (trackme_* by default, used to scope every TrackMe search) — are set under Configuration → System settings → Indexes. New tenants inherit these values unless you override them at creation:

Custom indexes per tenant¶

You can point a tenant at its own indexes when you create it — the Indexes & RBAC step of the tenant-creation wizard pre-fills the system defaults, and you can change any of the four roles (for example, to isolate a sensitive tenant into a dedicated summary/audit index). The metric role must be a metric index:

Tip

If you create tenant-specific indexes, use a strict prefix convention such as trackme_<context>_<index name> so the trackme_* global search filter keeps matching them.

Event sourcetypes¶

Events are JSON. The main sourcetypes:

Sourcetype	What it records
`trackme:audit`	Changes made to entities and configuration.
`trackme:flip`	Entity state transitions (see Status flapping).
`trackme:state`	Entity state snapshots.
`trackme:health`	Component and tracker health.
`trackme:sla_breaches`	SLA breach events.
`trackme:stateful_alerts`	Stateful incidents opened / updated / closed.
`trackme:notable`	Notable events from the notable alert action.
`trackme:smart_status`	SmartStatus automated-investigation results.
`trackme:handler`	TrackMe Handler events — traces backend logic execution such as hybrid trackers and the delayed entities inspector.

To enumerate the TrackMe sourcetypes present in your environment:

| tstats count where index=trackme_* by sourcetype

Metrics and logs¶

Metrics follow the trackme.* convention in the metrics index — the SLA state (trackme.sla.object_state), the feed KPIs (trackme.splk.feeds.*), workload counters (trackme.splk.wlk.*), operational health (trackme.components_register.*), and your own Flex / FQM metrics. The full catalogue, by component, is in the Metrics reference.
Logs land in _internal: the REST API as trackme:rest_api and custom commands as trackme:custom_commands:*. Their verbosity is the logging level set in the Configuration page.