Share data in Splunk IT Service Intelligence

When Splunk IT Service Intelligence is deployed on Splunk Enterprise, the Splunk platform sends usage data to Splunk Inc. ("Splunk") to help improve Splunk IT Service Intelligence in future releases. For information about how to opt in, and how the data is collected, stored, and governed, see Share data in Splunk Enterprise.

What data is collected

Splunk IT Service Intelligence collects the following basic usage information:

Component Description Example
app.ITSI.performanceMetrics Reports the time taken for a specific method to finish and non-identifiable supporting parameters to clean up the data (measured per 24 hours).
JSON 
{
   app: itsi
   component: app.ITSI.performanceMetrics
   data: {
     averageTime: 1.6168572306632996
     cumulativeTime: 6.467428922653198
     medianTime: 1.1328552961349487
     method: itoa_object.get_bulk
     numberOfObjects: 1012
     numberOfTransactions: 4
     p90Time: 2.975279831886292
   }
   deploymentID: 616ee3e9-532b-5b32-8679-0e58f7d3d336
   eventID: 9157E0BA-1A2A-48CC-A738-66AB5E5DEE33
   executionID: 38A07E6C-2CA7-4B6A-88DB-CB8ED52776D7
   optInRequired: 3
   timestamp: 1592906482
   type: aggregate
   visibility: [
     support
     anonymous
   ]
}
app.ITSI.entityTypes Reports the number of entities for each entity type (custom entity types are hashed).
JSON 
{
   app: itsi
   component: app.ITSI.entityTypes
   data: {
     countOfAssociatedEntities: 10
     entityTypeIds: a0745f7ed88cfac6058d1d4cfb57bc71127a28ad7c6756004142a90aab5ee99f
   }
   deploymentID: 417a2431-e14d-5550-b3dc-8d72442dc74a
   eventID: 51F77E4B-D866-49FB-B2F5-463258AC9FC7
   executionID: 661BB29D-A390-4B40-B17C-E5EFF48EE183
   optInRequired: 3
   timestamp: 1592820124
   type: aggregate
   visibility: [
     anonymous
     support
   ]
}
app.ITSI.entityTypeToEntityRatio Ratio of in-use entity types to entities.
JSON 
{
   app: itsi
   component: app.ITSI.entityTypeToEntityRatio
   data: {
     entityTypeToEntityRatio: 0.0007955449482895784
     numberOfEntities: 5028
     numberOfEntityTypes: 4
   }
   deploymentID: 616ee3e9-532b-5b32-8679-0e58f7d3d336
   eventID: BAC39F03-20BB-4D88-969F-072A9237581A
   executionID: 38A07E6C-2CA7-4B6A-88DB-CB8ED52776D7
   optInRequired: 3
   timestamp: 1592906593
   type: aggregate
   visibility: [
     support
     anonymous
   ]
}
app.ITSI.serviceToEntityRatio Reports the ratio of in-use services to entities.
JSON 
{
   app: itsi
   component: app.ITSI.serviceToEntityRatio
   data: {
     numberOfEntities: 128
     numberOfServices: 8
     serviceToEntityRatio: 0.0625
   }
   deploymentID: 639ae7f7-0af0-5a0f-b053-65a3662f230a
   eventID: 6A71F467-B4FE-4D4C-99F4-4F324DD01B72
   executionID: EC2EE972-58C2-441F-97B9-8921453AC341
   optInRequired: 3
   timestamp: 1592820188
   type: aggregate
   visibility: [
     anonymous
     support
   ]
}
app.ITSI.kpiToEntityRatio Reports the ratio of in-use KPIs to entities.
JSON 
{
   app: itsi
   component: app.ITSI.kpiToEntityRatio
   data: {
     kpiToEntityRatio: 0.20689655172413793
     numberOfEntities: 87
     numberOfKpis: 18
   }
   deploymentID: 121370bf-b9ce-54c5-96e0-f99a03242ef5
   eventID: 3341F59D-8290-4683-B4A9-3F7C09458CB3
   executionID: CC1CAA21-78DD-46C5-BEAA-5BFD690100E3
   optInRequired: 3
   timestamp: 1592733807
   type: aggregate
   visibility: [
     anonymous
     support
   ]
}
app.ITSI.sharedBaseSearchToEntityRatio Reports the ratio of in-use shared base searches to entities.
JSON 
{
   app: itsi
   component: app.ITSI.sharedBaseSearchToEntityRatio
   data: {
     numberOfEntities: 25080
     numberOfSharedBaseSearches: 5
     sharedBaseSearchToEntityRatio: 0.00019936204146730463
   }
   deploymentID: 616ee3e9-532b-5b32-8679-0e58f7d3d336
   eventID: 8F418716-926D-4D67-B31A-3732DBC4EC21
   executionID: 38A07E6C-2CA7-4B6A-88DB-CB8ED52776D7
   optInRequired: 3
   timestamp: 1592906664
   type: aggregate
   visibility: [
     support
     anonymous
   ]
}
app.ITSI.serviceAssociatedEntityToServiceUnassociatedEntityRatio Reports the number of entities by service association.
JSON 
{
   app: itsi
   component: app.ITSI.serviceAssociatedEntityToServiceUnassociatedEntityRatio
   data: {
     numberOfServiceAssociatedEntities: 5016
     numberOfServiceUnassociatedEntities: 12
     serviceAssociatedEntityToServiceUnassociatedEntityRatio: 418
   }
   deploymentID: 616ee3e9-532b-5b32-8679-0e58f7d3d336
   eventID: 965EC96C-33E4-44E2-B885-77CE071D3EEC
   executionID: 38A07E6C-2CA7-4B6A-88DB-CB8ED52776D7
   optInRequired: 3
   timestamp: 1592906664
   type: aggregate
   visibility: [
     anonymous
     support
   ]
}
app.session.ITSI.pageLoad Reports the time taken for a React component to load with associated metadata.
JSON 
{
   component: app.session.ITSI.pageLoad
   data: {
     app: itsi
     loadTime: 18398.775000008754
     metadata: {
       activeTabId: EVENT_DATA_SEARCH
       isInitialAppMount: true
     }
     mode: development
     page: entity_detail
   }
   deploymentID: 2b623070-88c3-51a2-bed6-8dd666600c60
   eventID: 768b9773-57c9-9549-5527-9346c7568899
   experienceID: 8268d610-95d7-5a6d-4e3e-c5ad9f561a5b
   optInRequired: 3
   timestamp: 1592356630
   userID: 5f4dba230c6b7e300aec79ea85261914c069f777452a207f26b56fb185892b27
   version: 4
   visibility: anonymous,support
}
app.session.pageView Reports the pages a user has visited.
JSON 
{
   component: app.session.pageview
   data: {
     app: itsi
     page: notable_event_aggregation_policy_detail_view
   }
   deploymentID: 0e55c2be-a373-5e5f-b9cf-34f0977566e1
   eventID: e4df5657-d13f-8f66-3958-21f0e4247439
   experienceID: 6cac0958-68e6-5a3b-631a-c7f407794280
   optInRequired: 3
   timestamp: 1592850392
   userID: 36966f73a802b0f3e37b385983f3d21d556b0c9d5e2e4bcd9163526bafe12320
   version: 4
   visibility: anonymous,support
}
app.session.udf.telemetry Reports information about visualizations and configurations that users implement in beta glass tables.
JSON 
component: app.session.udf.telemetry
   data: { [-]
     app: itsi
     definition: { [-]
       inputs: { [-]
         input1: { [-]
           options: { [-]
             items: 3
           }
           titleLength: 6
           type: input.dropdown
         }
       }
       layout: { [-]
         globalInputs: [ [-]
           input1
         ]
         options: { [-]
           height: 750
           width: 1300
         }
         structure: [ [-]
           { [-]
             item: viz_eGQh2uAJ
             position: { [-]
               h: 730
               w: 1280
               x: 10
               y: 10
             }
             type: block
           }
           { [-]
             item: viz_2WcVmXz0
             position: { [-]
               h: 450
               w: 770
               x: 260
               y: 20
             }
             type: block
         ]
         type: absolute
       }
       titleLength: 26
       visualizations: { [-]
         viz_2WcVmXz0: { [-]
           options: { [-]
             preserveAspectRatio: true
             src: true
           }
           type: viz.img
         }
         viz_5HKW2R1q: { [-]
           options: { [-]
             legend.placement: top
           }
           titleLength: 29
           type: viz.line
         }
       }
     }
     definitionInfo: { [-]
       componentCounts: { [-]
         dataSourceTypeCounts: { [-]
           ds.test: 11
         }
         inputTypeCounts: { [-]
           input.dropdown: 1
         }
         vizTypeCounts: { [-]
           abslayout.line: 6
           viz.img: 1
           viz.line: 2
           viz.rectangle: 1
           viz.singlevalue: 8
           viz.table: 1
           viz.text: 3
         }
       }
       numDataSources: 11
       numInputs: 1
       numViz: 22
     }
     page: boston_marathon__absolute__k0wxyjod/edit
     pageAction: dashboard.initialize
     udfVersion: 5.2.0
   }
   deploymentID: e5fc210a-8e27-54b6-b50e-306304917a3f
   eventID: 40c251b1-09ad-cb2d-cb64-c503c8e91695
   experienceID: 10fa783d-65c5-0ece-9808-416f92ccfd48
   timestamp: 1569281682
   userID: 0b9a7eef9855fe028ae96a4eeea30356bdd66dfeeae10002503a6e7dd9be0e92
   version: 3
   visibility: anonymous,support
app.ITSI.entityLifecycleManagement Number of entity lifecycle management policies having auto retire feature enabled on the Splunk system.
JSON 
{
   "timestamp":1648091047,
   "component":"app.ITSI.entityLifecycleManagement",
   "executionID":"64FB8F4D-5BB9-4D0E-9549-5E5FFFD883C8",
   "data":{
      "countOfRetirableEntities":0,
      "countOfEntityTypesUnderManagement":3,
      "countOfDisabledEntityManagementPolicies":9,
      "countOfEnabledEntityManagementPolicies":1,
      "countOfEntitiesUnderManagement":2,
      "countOfRetiredEntities":2,
      "countOfAutoRetireEntityManagementPolicies":1,
      "avgPolicyRunTime":4.65,
      "avgPolicyLookbackPeriod":26
   },
   "optInRequired":3,
   "visibility":[
      "anonymous",
      "support"
   ],
   "eventID":"0F66ABC6-83C4-4CD2-B762-415D2B2474DD",
   "type":"aggregate",
   "deploymentID":"91182b71-8c10-5019-8daa-6722bac9bc27",
   "app":"itsi"
}
app.ITSI.calculationWindowUsage Information about the types of calculation windows in ITSI.
JSON 
{
   app: itsi
   component: app.ITSI.calculationWindowUsage
   data: {
     customWindow: {
       calculationWindowValueCount: [
         {
           calculationWindowValue: 33
           count: 1
         }
       ]
       totalCount: 1
     }
     predefinedWindow: {
       calculationWindowValueCount: [
         {
           calculationWindowValue: 5
           count: 8
         }
       ]
       totalCount: 8
     }
   }
   deploymentID: a3b9b625-8392-5205-b4e8-350dd0491cbb
   eventID: 4ECEA390-74EB-48CF-B387-3808D68A7A3B
   executionID: 110B8DAD-B7F2-4E8B-8CB2-43390A8A253A
   optInRequired: 3
   timestamp: 1665082511
   type: aggregate
   visibility: [
     anonymous
     support
   ]
}
app.ITSI.knowledgeObjectsCounts Provides a count of various knowledge objects in ITSI.
JSON 
{
   "data":{
      "knowledgeObjects":{
         "authoredContentPacks": {
            "totalCount": 1
            },
         "eventManagementStates":{
            "totalCount":6,
            "privateCount":0,
            "publicCount":6
         },
         "glassTables":{
            "privateCount":0,
            "publicCount":2,
            "totalCount":2
         },
         "contentPacks":{
            "totalCount":1,
            "DA-ITSI-CP-CUST-63929313c0755967941cb2cd":1
         },
         "services":{
            "kpis":{
               "adhocCount":2,
               "totalCount":1013,
               "sharedBaseSearchCount":1011,
               "dataModelCount":0,
               "metricsCount":0
            },
            "dependServicesCount":86,
            "servicesLinkedToATemplate":96,
            "totalCount":96,
            "servicesNotInGlobal":2
         },
         "deepDives":{
            "publicCount":1,
            "privateCount":1,
            "totalCount":2
         },
         "correlationSearches":{
            "totalCount":7
         },
         "maintenanceWindows":{
            "totalCount":0
         },
         "homeViews":{
            "privateCount":0,
            "totalCount":11,
            "publicCount":11
         },
         "entityManagementRules":{
            "totalCount":1
         },
         "kpiBaseSearches":{
            "totalCount":99
         },
         "entityManagementPolicies":{
            "totalCount":0
         },
         "authoredContentPacks":{
            "totalCount":1
         },
         "entityTypes":{
            "totalCount":10
         },
         "entities":{
            "totalCount":2216
         },
         "kpiTemplates":{
            "totalCount":33
         },
         "notableEventAggregationPolicies":{
            "totalCount":6
         },
         "customThresholdWindows":{
            "totalCount":0
         },
         "kpiThresholdTemplates":{
            "totalCount":36
         },
         "teams":{
            "totalCount":5
         },
         "serviceTemplates":{
            "totalCount":10
         }
      }
   }
}
app.ITSI.ATUsage Provides a count of KPIs with thresholds generated by Splunk AI, and services using adaptive thresholding or using KPIs that have thresholds generated by Splunk AI.
JSON 
{
  "timestamp": 1633320026,
  "component": "app.ITSI.ATUsage",
  "executionID": "ECF66CEF-00EC-4EB3-817A-C0CF6A24C24F",
  "data": {
        "kpis_using_at": 170,
        "kpis_using_policies": {
            "percentage": 4,
            "stdev": 124,
            "static": 51,
            "range": 1,
            "quantile": 3
        },
        "kpis_using_threshold_templates": {
            "kpi_threshold_template_3_stdev": 104,
            "kpi_threshold_template_3_quantile": 2,
            "kpi_threshold_template_2_stdev": 2,
            "kpi_threshold_template_8_stdev": 1
        },
        "kpis_using_custom_thresholds": 61,
        "kpis_using_recommendation": 0,
        "kpis_with_recommendations_modified": 0,
        "services_using_at": 117,
        "services_using_custom_thresholds": 16,
        "services_using_recommendation": 0,
        "services_with_recommendations_modified": 0,
        "min_threshold_level": {
            "percentage": 0,
            "stdev": -12.18,
            "range": 0,
            "quantile": 0
        },
        "max_threshold_level": {
            "percentage": 90,
            "stdev": 12.18,
            "range": 0.75,
            "quantile": 0.97
        }
    },
  "optInRequired": 3,
  "visibility": [
    "anonymous",
    "support"
  ],
  "eventID": "FAA1804F-F2C5-47A1-B06B-DED1CB31F252",
  "type": "aggregate",
  "deploymentID": "91182b71-8c10-5019-8daa-6722bac9bc27",
  "app": "itsi"
}
app.session.ITSI.componentInteraction Tracks user interactions with various UI elements to understand how users accomplish a specific goal.
JSON 
{
    "optInRequired":3,
    "visibility":"anonymous,support",
    "experienceID":"166287aa-3c8d-fdd0-a17f-90aa0fe39596",
    "version":"4",
    "timestamp":1691621685,
    "data":{
        "itsiComponent":"ServiceSandbox",
        "page":"service_sandbox",
        "action":"Save",
        "app":"itsi",
        "numberOfChangesApplied":2
    },
    "splunkVersion":"9.0.0",
    "component":"app.session.ITSI.componentInteraction",
    "eventID":"1f4f5b55-55f7-fb0a-3559-b1cfe78b0734",
    "deploymentID":"68058ae0-9a56-55f0-bf4b-dd603e22c7aa",
    "original_timestamp":1691621685,
    "original_event_id":"76e9282e78b0fc8cec7a2a6358967360d6638f54f4abab8a1770aea10d1d5a3e",
    "userID":"28586f93ca33c3ae5365473820acf0230abdcb1481e955eea288a99291d81bd4"
}
app.ITSI.performanceMetrics Measures amount of time taken by specific backend functions.
JSON 
{
   app: itsi
   component: app.ITSI.performanceMetrics
   data: {
     averageTime: 0.01605749130249
     cumulativeTime: 0.03211498260498
     medianTime: 0.01605749130249
     method: validate_sandbox
     numberOfTransactions: 2
     p90Time: 0.016411876678467
   }
   deploymentID: e950e291-0ffc-5b55-9435-c43caa398d95
   eventID: 78D10842-382A-4A2D-9970-CDE81F738FBE
   executionID: 15BEDE8E-6FEC-4C3C-9C17-42E18448157D
   optInRequired: 3
   original_event_id: d9407d4db9c3aed0194d5ef4fd5c5bceb28097e5088d154f0f0c29cb713746e5
   original_timestamp: 1696363278
   timestamp: 1696363278
   type: aggregate
   visibility: [
     anonymous
     support
   ]
}
app.ITSI.entityDiscoverySearchCleanupCommand Information about when the CleanupEntityDiscoverySearches command is used.
JSON 
{
   app: itsi
   component: app.ITSI.entityDiscoverySearchCleanupCommand
   data: {
     cleaned_entities: 5
     end_time_int: 1696343197.1711
     has_error: 0
     host: ash-vm1
     roles_for_current_user: ['admin']
     start_time_int: 1696343195.432
     tid: db50487861f811eeb32c00505696f8f7
   }
   deploymentID: 7e475054-ba16-51d7-8ea5-c5a7856b6e64
   eventID: 585DDA3D-7EDB-4378-B2DA-1DD9DC606E1C
   executionID: 8C7FFB2E-2FE6-491A-96F2-D15EAD14FCB7
   optInRequired: 3
   original_event_id: ecfe876186665569e1223b1373f223bcacd22593992bf179ff4a44780f2890e5
   original_timestamp: 1696384807
   timestamp: 1696384807
   type: aggregate
   visibility: [
     anonymous
     support
   ]
}
app.ITSI.entitybulkimport Information about the time spent during various stages of bulk entity import, or discovery searches for entities.
JSON 
4/22/24
5:59:15.832 PM	
2024-04-22 17:59:15,832+0000 process:2220655 thread:MainThread INFO [itsi.bulk_import] [contextlib:126] [exit] Finished tid=fa393b6700d111efa71512488dcd2577 method=EntityUpdaterV2._get_existing_entities_v2 start_time=1713808746.1658652 end_time=1713808755.8324 transaction_time=9.666534900665283 owner='None'
host = sh-i-04136a07b5e8ddf66.npasoli-16387903.stg.splunkcloud.comsource = /opt/splunk/var/log/splunk/itsi_command_itsi_import_objects.logsourcetype = itsi_internal_log
4/22/24
5:59:06.165 PM	
2024-04-22 17:59:06,165+0000 process:2220655 thread:MainThread INFO [itsi.bulk_import] [contextlib:119] [enter] Invoked tid=fa393b6700d111efa71512488dcd2577 method=EntityUpdaterV2._get_existing_entities_v2 start_time=1713808746.1658652 owner='None'
host = sh-i-04136a07b5e8ddf66.npasoli-16387903.stg.splunkcloud.comsource = /opt/splunk/var/log/splunk/itsi_command_itsi_import_objects.logsourcetype = itsi_internal_log

 

4/22/24
5:59:15.702 PM	
2024-04-22 17:59:15,702+0000 process:2220655 thread:MainThread INFO [itsi.bulk_import] [contextlib:126] [exit] Finished tid=fa393b6700d111efa71512488dcd2577 method=EntityUpdaterV2._execute_multithreaded_entity_get start_time=1713808746.1802654 end_time=1713808755.7026548 transaction_time=9.52238941192627 owner='None'
host = sh-i-04136a07b5e8ddf66.npasoli-16387903.stg.splunkcloud.comsource = /opt/splunk/var/log/splunk/itsi_command_itsi_import_objects.logsourcetype = itsi_internal_log
4/22/24
5:59:06.180 PM	
2024-04-22 17:59:06,180+0000 process:2220655 thread:MainThread INFO [itsi.bulk_import] [itoa_bulk_import_entity_updater:578] [_execute_multithreaded_entity_get] tid=fa393b6700d111efa71512488dcd2577 len(batched_workload)=50, no_of_threads=10, args:(), kwargs:{'key_field': 'identifying_name'}
host = sh-i-04136a07b5e8ddf66.npasoli-16387903.stg.splunkcloud.comsource = /opt/splunk/var/log/splunk/itsi_command_itsi_import_objects.logsourcetype = itsi_internal_log

4/22/24
3:51:40.475 PM	
2024-04-22 15:51:40,475+0000 process:1464786 thread:MainThread INFO [itsi.bulk_import] [contextlib:126] [exit] Finished tid=23f77bb000c011efafa61211fe0f2f67 method=EntityUpdaterV2._get_existing_entities_for_fqdn start_time=1713801087.418286 end_time=1713801100.4757488 transaction_time=13.057462692260742 owner='None'
host = sh-i-0bb2cc3d075f721cb.npasoli-16388392.stg.splunkcloud.comsource = /opt/splunk/var/log/splunk/itsi_command_itsi_import_objects.logsourcetype = itsi_internal_log
4/22/24
3:51:27.418 PM	
2024-04-22 15:51:27,418+0000 process:1464786 thread:MainThread INFO [itsi.bulk_import] [contextlib:119] [enter] Invoked tid=23f77bb000c011efafa61211fe0f2f67 method=EntityUpdaterV2._get_existing_entities_for_fqdn start_time=1713801087.418286 owner='None'
host = sh-i-0bb2cc3d075f721cb.npasoli-16388392.stg.splunkcloud.comsource = /opt/splunk/var/log/splunk/itsi_command_itsi_import_objects.logsourcetype = itsi_internal_log
app.SA-ITSI-DriftDetection Capture details of the detected drifts, including drift type, length, and segments of accumulated drifts.
JSON 
{ app: detectdrift
   component: app.SA-ITSI-DriftDetection
   data: { 
     asctime: 2024-05-16 13:40:22,254
     created: 1715892022.254040
     df_length: 277
     df_time_span: 275 days 23:00:00
     event_type: calling_detect_drifts
     kpi_id: kpi_id
     logtype: telemetry
     name: sa-itsi-driftdetection-telemetry
     pid: 90210
     service_id: service_id
     threshold: 80
     threshold_direction: both
   }
   deploymentID: 5bc6da02-eb7d-587f-822d-f8963128734e
   eventID: 071455E8-75B9-439E-9648-5BA740E1BC49
   executionID: 1EB266FC-A7F7-4532-B716-35C9713744A5
   optInRequired: 3
   original_event_id: 17c3e32b8c0bd5bbfec4aa3657cd0475d242e99326ab6f0b2fe31c61cddc225b
   original_timestamp: 1715977860
   timestamp: 1715977860
   type: aggregate
   visibility: 
}
app.SA-ITSI-AT-Recommendations Logs when the pattern detection for a KPI/entity is completed and tracks the efficiency of the KPI workflow.
JSON 
app: SA-ITSI-AT-Recommendations
   component: app.SA-ITSI-AT-Recommendations
   data: { 
     asctime: 2024-05-09 10:45:24,780
     count_of_processed_ids: 1
     created: 1715276724.780108
     entity_key: 130e1f7f-ad8b-4718-9d9b-acef32af244f
     entity_level_processing: True
     entity_title: e6e0c4d9830348ec0074eb09d106869103350dde243a25a0fbf1413e861de5d4
     event_type: kpis_processing_complete
     logtype: telemetry
     name: sa-itsi-at-recommendations-telemetry
     pid: 98966
     processing_time: 23.20849s
   }
   deploymentID: 486b83b7-904d-582e-b316-2849a706f4d2
   eventID: 7F45040E-CE23-46B1-8DE4-368B052A13CB
   executionID: C2D316B6-E21F-41C8-A43F-7F4F3F366F5C
   optInRequired: 3
   original_event_id: e7b8d976ba993bbb945b5b6042c45fb271fb739d84be7e51963443fa53608e2b
   original_timestamp: 1715343811
   timestamp: 1715343811
   type: aggregate
   visibility: [ 
     anonymous
   ]
}
app.ITSI.EAEventOnboarding Metrics about the types of data integration connections that users create.
JSON 
{
    "data": {
        "generic": {
            "active": 0,
            "inactive": 0,
            "titles": []
        },
        "nagios": {
            "active": 0,
            "inactive": 0,
            "titles": []
        },
        "solarwinds": {
            "active": 0,
            "inactive": 0,
            "titles": []
        },
        "o11y": {
            "active": 0,
            "inactive": 1,
            "titles": [
                "olly_default"
            ]
        },
        "scom": {
            "active": 0,
            "inactive": 0,
            "titles": []
        },
        "appdynamics": {
            "active": 0,
            "inactive": 1,
            "titles": [
                "appdynamics_default"
            ]
        },
        "cloudtrail": {
            "active": 0,
            "inactive": 0,
            "titles": []
        }
    }
}
app.ITSI.EANats Metrics about NATS performance in Event Analytics.
JSON 
{
    "data": {
        "eventProcessingLatency": "0.5553472222222222",
        "queueEnabled": "1",
        "cpuAverage": "0.05017667844522968",
        "memAverage": "31.762409893992928",
        "eventsBackfilledPerMinute": "0",
        "eventsProcessedPerMinute": "20",
        "eventsIngestedPerMinute": "20",
        "rulesEngineStarted": "0",
        "rulesEngineStopped": "0"
    }
}
app.ITSI.entityNormalizationGeneration Metrics about the Entity Normalization dashboard.
JSON 
{
        "component": "app.session.ITSI.componentInteraction",
        "data": {
            "itsiComponent": "EntityNormalizationDashboard:AccessDashboard",
            "action": "visit",
            "duplicateEntitiesGroupByAliasApiStatus": "DUPLICATE_ENTITIES_GROUP_BY_ALIAS_RETRIEVE_SUCCESS",
            "app": "itsi",
            "page": "duplicate_entities_management"
        },
        "timestamp": 1733413799,
        "visibility": "anonymous,support",
        "experienceID": "8e1b7a07-0f61-7ead-b6b2-8575fba25aef",
        "deploymentID": "f5b56191-43dd-5178-ba64-71b113acb8c5",
        "userID": "d8eeb14f358916559425f73e1ed10402ee16bc83d5cb330fb6a71f6026deb549",
        "eventID": "efc5aa20-7ee5-8181-71bc-cc93b8a4cf15",
        "splunkVersion": "9.2.1",
        "optInRequired": 3,
        "version": "4"
    }
app.ITSI.performanceMetrics Amount of time that it takes for specific backend functions to run.
JSON 
{
   "timestamp":1733713318,
   "original_event_id":"b3100d9956423a794815cf4535ceca107c6a5e47da36c0adfb3aeb3ccb86238e",
   "component":"app.ITSI.performanceMetrics",
   "eventID":"50A9F98B-082D-4CE5-A2F7-7E00B642F002",
   "original_timestamp":1733713318,
   "app":"itsi",
   "visibility":[
      "anonymous",
      "support"
   ],
   "optInRequired":3,
   "data":{
      "p90Time":0.28068695068359,
      "method":"DuplicateEntitiesManagerJob.kickstart_duplicate_entities_remediation_or_generation_job",
      "numberOfTransactions":288,
      "medianTime":0.13839685916901,
      "cumulativeTime":48.801737785339,
      "averageTime":0.16945047842132
   },
   "type":"aggregate",
   "executionID":"A7D2DF9E-A1CB-4282-9324-4DFA6DCBE192",
   "deploymentID":"cfc2bd17-2c0c-5571-8bb2-7d2626b2bcb4"
}
app.SA-ITSI-AlertCorrelation Logs the initial parameters for alert grouping, such as the minimum similarity score required to group alerts.
JSON 
{ 
   app: SA-ITSI-AlertCorrelation
   component: app.SA-ITSI-AlertCorrelation
   data: { 
   }
   deploymentID: 79603bfc-2198-5940-af78-5df813143ac0
   eventID: CBFE7B0C-D356-450F-B94F-219F51C95011
   executionID: 68452B41-5BD3-4F87-B15D-1F5315D8A31A
   optInRequired: 3
   original_event_id: 0d7bf2e3cc68c03d98b57e471864ec7036341b7bf5fda7219135098a1a3421ad
   original_timestamp: 1739676788
   timestamp: 1739676788
   type: aggregate
   visibility: [ 
   ]
}