Data model

This topic provides details on the data model of TrueSight Intelligence.

What data can you collect for analyzing?

Almost everything! TrueSight Intelligence provides a solution to assist with your need to visualize, explore, and analyze data that impacts your systems and business.

TrueSight Intelligence data model

Metrics data model

Metric definitions provide performance information for a source, which is an instance of a source type. Source types and metric definitions are used to define the metrics, and providing information that enables you to send measures (values) for these metrics.

Define metrics and send measures data

You must follow the recommended sequence for defining metrics and sending measures data to TrueSight Intelligence.

Apps and app associations

Apps provide you the capability to associate data from multiple sources, and view this data collectively for the purpose of analytics.

Metric data is tagged when a measurement is sent with the app_id at the source.
For events, the tag ID field is used for specifying the name of the app.

In the following example, metric data from Source_1 and Source_3 is associated to App X, whereas data from Source_2, Source_4, and Source_5 is associated to App Y.

Events data model

Events provide you the flexibility to send and visualize any set of values at a given point in time.

Click here to view a description for the event fields.

Fields	Description
eventId	Unique ID for the event
createdAt	Epoch time when the event was created. Automatically set by the server, if not specified.
receivedAt	Epoch time when the event was received by the server
Title	Text field to specify the title
EventClass	Categorize similar events
Fingerprint fields	List of fields used to uniquely identify an event
Properties	(optional) Custom properties for an event
Tags	Any tag. For example, app_id="my app"
Source	Source of the event
Sender	Sender of the event
Message	Text field to specify a detailed message
Severity	Event severity. For example, info, minor, major
Status	Event status. For example, open, close

Send event data

Events are uniquely identified by the fingerprint fields and grouped by event class.

Fingerprint fields are defined to have unique values that do not change with time. For example, an event ID is used to identify an event, and the status of the event can be either 'open' or 'close'. The event ID field is never updated in this case. If the value for any fingerprint field is changed, a new event is created.

Tip

Ensure that the value of the fingerprint fields are not changed when sending multiple values for other event parameters.

Specify any key:values pairs as part of the event definition. A maximum of 128 fields can be defined for each event, provided the total size of each event is less than 32K.

Where to go from here

Quick-start