All Apps and Add-ons
Highlighted

Splunk Common Information Model: Can someone clarify the intended use of the various parameters for the "type" field under the Alerts data model?

Builder

Hello,

Can someone please clarify the intended use for the various parameters for the type field under the Alerts data model?

e.g.
alarm, alert, event, task, unknown

0 Karma
Highlighted

Re: Splunk Common Information Model: Can someone clarify the intended use of the various parameters for the "type" field under the Alerts data model?

Splunk Employee
Splunk Employee

Hi,

the goal for this data model is to enable machine learning against normalized alerting systems... for instance, questions like "how many informational-severity events are coming out of the various systems that monitor our billing services."

That said, the subtle difference between an alert and alarm is over my head as well.

0 Karma