Splunk Common Information Model: Can someone clarify the intended use of the various parameters for the "type" field under the Alerts data model?

[daniel333]

Hello,

Can someone please clarify the intended use for the various parameters for the type field under the Alerts data model?

e.g.
alarm, alert, event, task, unknown

[jcoates_splunk]

Hi,

the goal for this data model is to enable machine learning against normalized alerting systems... for instance, questions like "how many informational-severity events are coming out of the various systems that monitor our billing services."

That said, the subtle difference between an alert and alarm is over my head as well.