Data model

This topic provides details on the data model of TrueSight Intelligence.

What data can you collect for analyzing?

Almost everything! TrueSight Intelligence provides a solution to assist with your need to visualize, explore, and analyze data that impacts your systems and business.

TrueSight Intelligence data model


Metrics data model

Metric definitions provide performance information for a source, which is an instance of a source type. Source types and metric definitions are used to define the metrics, and providing information that enables you to send measures (values) for these metrics.

Define metrics and send measures data

You must follow the recommended sequence for defining metrics and sending measures data to TrueSight Intelligence.

Apps and app associations

Apps provide you the capability to associate data from multiple sources, and view this data collectively for the purpose of analytics.

  • Metric data is tagged when a measurement is sent with the app_id at the source.
  • For events, the tag ID field is used for specifying the name of the app.

In the following example, metric data from Source_1 and Source_3 is associated to App X, whereas data from Source_2, Source_4, and Source_5 is associated to App Y.

Events data model

Events provide you the flexibility to send and visualize any set of values at a given point in time.

 Click here to view a description for the event fields.
eventIdUnique ID for the event
createdAtEpoch time when the event was created.
Automatically set by the server, if not specified.
receivedAtEpoch time when the event was received by the server
TitleText field to specify the title
EventClassCategorize similar events
Fingerprint fieldsList of fields used to uniquely identify an event
Properties(optional) Custom properties for an event
TagsAny tag. For example, app_id="my app"
SourceSource of the event
SenderSender of the event
MessageText field to specify a detailed message
SeverityEvent severity. For example, info, minor, major
StatusEvent status. For example, open, close

Send event data

Events are uniquely identified by the fingerprint fields and grouped by event class.

Fingerprint fields are defined to have unique values that do not change with time. For example, an event ID is used to identify an event, and the status of the event can be either 'open' or 'close'. The event ID field is never updated in this case. If the value for any fingerprint field is changed, a new event is created.


Ensure that the value of the fingerprint fields are not changed when sending multiple values for other event parameters.

Specify any key:values pairs as part of the event definition. A maximum of 128 fields can be defined for each event, provided the total size of each event is less than 32K.

Where to go from here

Quick start

Was this page helpful? Yes No Submitting... Thank you