Docs » Integrations Guide » Integrations Reference » Splunk Infrastructure Monitoring Organization Metrics

Splunk Infrastructure Monitoring Organization Metrics đź”—

DESCRIPTION đź”—

Splunk Infrastructure Monitoring provides the following types of metrics that measure your usage:

  • Ingest metrics: Measure the data you’re sending to Infrastructure Monitoring, such as the number of datapoints you’ve sent
  • App usage metrics: Measure your use of application features, such as the number of dashboards in your organization
  • Integration metrics: Measure the use cloud services integrated with your organization, such as the number of calls to the AWS CloudWatch API
  • Metrics that measure your use of resources for which you can specify limits, such as the number of custom MTS you’ve created

You’re not charged for these metrics, and they do not count against any limits.

USAGE đź”—

If you’re an admin, you can view some of these metrics in built-in charts on the Organization Overview page. Anyone can display these metrics in custom charts.

Metrics for values by token đź”—

In some cases, Infrastructure Monitoring has two similar metrics:

  • One metric, such as sf.org.numAddDatapointCalls, represents the total across your entire organization.
  • The similar metric, sf.org.numAddDatapointCallsByToken represents the total for each unique access token you use.

The sum of all the by token metric values for a measurement might be less than the total value metric value. For example, the sum, of all sf.org.numAddDatapointCallsByToken values might be less than the value of sf.org.numAddDatapointCalls. The sums differ because Infrastructure Monitoring doesn’t use a token to retrieve data from cloud services you’ve integrated. Infrastructure Monitoring counts the datapoint calls for the integrated services, but it doesn’t have a way to count the calls for any specific token.

This difference in values applies to AWS CloudWatch, GCP StackDriver, AppDynamics, and New Relic integrations.

Metrics with values for each metric type đź”—

Some metrics have a value for each metric type (counter, cumulative counter, or gauge), so you have three MTS per metric. Each MTS has a dimension named category with a value of COUNTER, CUMULATIVE_COUNTER, or GAUGE. Because you can have multiple MTS for these metrics, you need to use the sum() SignalFlow function to see the total value.

For example, you might receive three MTS for sf.org.numMetricTimeSeriesCreated, one for the number of MTS that are counters, another for the number of MTS that are cumulative counters, and a third for the number of MTS that are gauges.

Also, you can filter by a single value of category, such as GAUGE, to see only the metrics of that type.

A metric that counts stopped detectors đź”—

The metric sf.org.numDetectorsAborted monitors the number of detectors that Infrastructure Monitoring stopped because the detector reached a resource limit. In most cases, the detector exceeds the limit of 250K MTS. MTS exceeds 250K. This condition also generates the event sf.org.abortedDetectors, which records details including the detector ID, the reason it stopped, and the value or limit of MTS or datapoints, whichever caused the detector to stop.

To learn more, see View Additional Data With Events.

Metrics that track system limits đź”—

These metrics track limits that Infrastructure Monitoring enforces for your organization:

  • sf.org.limit.activeTimeSeries (gauge): Maximum number of active MTS, within a moving window of the past 25 hours, that your organization can have. If you exceed this limit, Infrastructure Monitoring stops accepting data points for new MTS, but continues to accept data points for existing MTS. To monitor your usage against the limit, use the metric sf.org.numActiveTimeSeries.
  • sf.org.limit.containers (gauge): Maximum number of containers that can send data to your organization. This limit is higher than your contractual limit to allow for burst and overage usage. If you exceed this limit, Infrastructure Monitoring drops datapoints from new containers but keeps accepting data points for existing containers. To monitor your usage against the limit, use the metric sf.org.numResourcesMonitored and filter for the dimension resourceId:containers.
  • sf.org.limit.customMetricTimeSeries (gauge): Maximum number of active custom MTS, within a moving window of the previous 60 minutes, that can send data to your organization. If you exceed this limit, Infrastructure Monitoring drops data points for the custom MTS that exceeded the limit, but it continues to accept data points for custom MTS that already existed. you’ve defined, use the metric sf.org.numCustomMetrics. To learn more about custom MTS, see the section About custom, bundled, and high-resolution metrics in the user documentation.
  • sf.org.limit.detector (gauge): Maximum number of detectors that you can use for your organization. After you reach this limit, you can’t create new detectors. To monitor the number of detectors you create, use the metric sf.org.num.detector.
  • sf.org.limit.hosts (gauge): Maximum number of hosts that can send data to your organization. The limit is higher than your contractual limit to allow for burst and overage usage. If you exceed this limit, Infrastructure Monitoring drops data points from new hosts but keeps accepting data points for existing hosts. To monitor your usage against the limit, use the metric sf.org.numResourcesMonitored and filter for the dimension resourceId:hosts.
  • sf.org.limit.metricTimeSeriesCreatedPerMinute (gauge): Maximum rate at which you can create new MTS in your organization, measured in MTS per minute. If you exceed this rate, Infrastructure Monitoring stops accepting data points for new MTS, but continues to accept data points for existing MTS. To monitor the number of metrics you’ve created overall, use the metric sf.org.numMetricTimeSeriesCreated.

Compare gross and num metric values đź”—

Some metrics report a gross value and a num value. Compare the gross and num values of a metric to learn about how the system limits or filters data for whatever the metric represents.

A gross metric reports the total number of datapoints the system receives before any throttling or filtering kicks in.

A num metric reports the total number of datapoints the system receives after it completes any throttling or filtering.

Metrics đź”—

  • sf.org.abortedDetectors (cumulative)
    Contains the detectorID and reason for abort with the value/limit of MTS, or data points, whichever caused the detector to stop
  • sf.org.apm.grossContentBytesReceived (counter)
    The volume of bytes Splunk APM receives off the wire before filtering and throttling. This content could be compressed.
    • Dimension(s): orgId
    • Data resolution: 1 second
  • sf.org.apm.grossContentBytesReceivedByToken (counter)
    The volume of bytes Splunk APM receives off the wire for a specific access token before filtering and throttling. This content could be compressed.
    • Dimension(s): orgId, tokenId
    • Data resolution: 1 second
  • sf.org.apm.grossSpanBytesReceived (counter)
    The number of bytes Splunk APM receives from spans after decompression but before filtering and throttling.
    • Dimension(s): orgId
    • Data resolution: 1 second
  • sf.org.apm.grossSpanBytesReceivedByToken (counter)
    The number of bytes Splunk APM receives for a specific access token from ingested span data after decompression but before filtering and throttling.
    • Dimension(s): orgId, tokenId
    • Data resolution: 1 second
  • sf.org.apm.grossSpansReceived (counter)
    The number of spans Splunk APM received before filtering or throttling.
    • Dimension(s): orgId
    • Data resolution: 1 second
  • sf.org.apm.grossSpansReceivedByToken (counter)
    The number of spans Splunk APM receives for a specific access token before filtering or throttling.
    • Dimension(s): orgId, tokenId
    • Data resolution: 1 second
  • sf.org.apm.numAddSpansCalls (counter)
    The number of calls to the /v2/trace endpoint.
    • Dimension(s): orgId
    • Data resolution: 1 second
  • sf.org.apm.numAddSpansCallsByToken (counter)
    The number of calls to the /v2/trace endpoint for a specific access token.
    • Dimension(s): orgId, tokenId
    • Data resolution: 1 second
  • sf.org.apm.numContainers (gauge)
    The number of containers actively sending data to Splunk APM.
    • Dimension(s): orgId
    • Data resolution: 1 minute
  • sf.org.apm.numContentBytesReceived (counter)
    The volume of bytes Splunk APM accepts off the wire after filtering and throttling. This content could be compressed.
    • Dimension(s): orgId
    • Data resolution: 1 second
  • sf.org.apm.numContentBytesReceivedByToken (counter)
    The volume of bytes Splunk APM accepts off the wire for a specific access token after filtering and throttling. This content could be compressed.
    • Dimension(s): orgId, tokenId
    • Data resolution: 1 second
  • sf.org.apm.numHosts (gauge)
    The number of hosts that are actively sending data to Splunk APM.
    • Dimension(s): orgId
    • Data resolution: 1 minute
  • sf.org.apm.numSpanBytesReceived (counter)
    The number of bytes Splunk APM accepts from ingested span data after decompression after filtering and throttling.
    • Dimension(s): orgId
    • Data resolution: 1 second
  • sf.org.apm.numSpanBytesReceivedByToken (counter)
    The number of bytes Splunk APM accepts for a specific access token for a span after decompression after filtering and throttling.
    • Dimension(s): orgId, tokenId
    • Data resolution: 1 second
  • sf.org.apm.numSpansDroppedInvalid (counter)
    The number of invalid spans Splunk APM receives. A span can be invalid if there is no start time, trace ID, or service associated with it, or if there are too many spans in the trace.
    • Dimension(s): orgId
    • Data resolution: 1 second
  • sf.org.apm.numSpansDroppedInvalidByToken (counter)
    The number of invalid spans Splunk APM receives for a specific access token. A span can be invalid if there is no start time, trace ID, or service associated with it, or if there are too many spans in the trace.
    • Dimension(s): orgId, tokenId
    • Data resolution: 1 second
  • sf.org.apm.numSpansDroppedOversize (counter)
    The number of spans Splunk APM receives that are too large to process.
    • Dimension(s): orgId
    • Data resolution: 1 second
  • sf.org.apm.numSpansDroppedOversizeByToken (counter)
    The number of spans Splunk APM receives that are too large to process for a specific access token.
    • Dimension(s): orgId, tokenId
    • Data resolution: 1 second
  • sf.org.apm.numSpansDroppedThrottle (counter)
    The number of spans Splunk APM dropped after you exceeded the allowed ingest volume. Splunk APM drops spans it receives after the ingestion volume limit is reached.
    • Dimension(s): orgId
    • Data resolution: 1 second
  • sf.org.apm.numSpansDroppedThrottleByToken (counter)
    The number of spans Splunk APM received for a specific access token beyond the allowed ingest volume. Splunk APM drops spans it receives after the ingestion volume limit is reached.
    • Dimension(s): orgId, tokenId
    • Data resolution: 1 second
  • sf.org.apm.numSpansReceived (counter)
    The number of spans Splunk APM accepts after filtering and throttling.
    • Dimension(s): orgId
    • Data resolution: 1 second
  • sf.org.apm.numSpansReceivedByToken (counter)
    The number of spans Splunk APM received for a specific access token after filtering and throttling.
    • Dimension(s): orgId, tokenId
    • Data resolution: 1 second
  • sf.org.apm.numTracesReceived (counter)
    The number of traces Splunk APM receives and processes.
    • Dimension(s): orgId
    • Data resolution: 1 minute
  • sf.org.apm.numTroubleshootingMetricSets (counter)
    The cardinality of Troubleshooting MetricSets for each 1-minute time window.
    • Dimension(s): orgId
    • Data resolution: 1 minute
  • sf.org.apm.numTroubleshootingMetricSets10s (gauge)
    The cardinality of Troubleshooting MetricSets for each 10-second window.
    • Dimension(s): orgId
    • Data resolution: 10 seconds
  • sf.org.apm.subscription.containers (gauge)
    The entitlement for the number of containers for your subscription plan.
    • Dimension(s): orgId
    • Data resolution: 2 minutes
  • sf.org.apm.subscription.hosts (gauge)
    The entitlement for the number of hosts for your subscription plan.
    • Dimension(s): orgId
    • Data resolution: 2 minutes
  • sf.org.apm.subscription.monitoringMetricSets (gauge)
    The entitlement for the number of Monitoring MetricSets as part of your subscription plan.
    • Dimension(s): orgId
    • Data resolution: 2 minutes
  • sf.org.apm.subscription.spanBytes (gauge)
    The entitlement for the number of bytes per minutes for your subscription plan.
    • Dimension(s): orgId
    • Data resolution: 2 minutes
  • sf.org.apm.subscription.traces (gauge)
    The entitlement for the number of traces analyzed per minute (TAPM) as part of your subscription plan.
    • Dimension(s): orgId
    • Data resolution: 2 minutes
  • sf.org.apm.subscription.troubleshootingMetricSets (gauge)
    The entitlement for the number of Troubleshooting MetricSets as part of your subscription plan.
    • Dimension(s): orgId
    • Data resolution: 2 minutes
  • sf.org.grossDatapointsReceived (cumulative)
    sf.org.grossDatapointsReceived is reserved for Infrastructure Monitoring internal use only.
  • sf.org.grossDatapointsReceivedByToken (cumulative)
    sf.org.grossDatapointsReceivedByToken is reserved for Infrastructure Monitoring internal use only.
  • sf.org.limit.activeTimeSeries (gauge)
    Maximum number of active MTS, within a moving window of the past 25 hours, that your organization can have. If you exceed this limit, Infrastructure Monitoring stops accepting data points for new MTS, but continues to accept data points for existing MTS. To monitor your usage against the limit, use the metric sf.org.numActiveTimeSeries.
  • sf.org.limit.containers (gauge)
    Maximum number of containers that can send data to your organization. This limit is higher than your contractual limit to allow for burst and overage usage. If you exceed this limit, Infrastructure Monitoring drops datapoints from new containers but keeps accepting data points for existing containers. To monitor your usage against the limit, use the metric sf.org.numResourcesMonitored and filter for the dimension resourceId:containers.
  • sf.org.limit.customMetricTimeSeries (gauge)
    Maximum number of active custom MTS, within a moving window of the previous 60 minutes, that you’re allowed to have in your organization. If you exceed this limit, Infrastructure Monitoring stops accepting data points for new custom MTS, but it continues to accept data points for custom MTS that already existed. To see the number of MTS you’re allowed to have, use the metric sf.org.numCustomMetrics. To learn more about custom MTS, see the section About custom, bundled, and high-resolution metrics in the user documentation.
  • sf.org.limit.hosts (gauge)
    Maximum number of hosts that can send data to your organization. This limit is higher than your contractual limit to allow for burst and overage usage. If you exceed this limit, Infrastructure Monitoring drops data points from new hosts but keeps accepting data points for existing hosts. To monitor your usage against the limit, use the metric sf.org.numResourcesMonitored and filter for the dimension resourceId:hosts.
  • sf.org.limit.metricTimeSeriesCreatedPerMinute (gauge)
    Maximum rate at which you can create new MTS in your organization, measured in MTS per minute. If you exceed this rate, Infrastructure Monitoring stops accepting data points for new MTS, but continues to accept data points for existing MTS. To monitor the number of metrics you’ve created overall, use the metric sf.org.numMetricTimeSeriesCreated.
  • sf.org.num.alertmuting (gauge)
    Total number of alert muting rules; includes rules currently in effect and rules not currently in effect (e.g. scheduled muting rules).
    • Dimension(s): orgId
    • Data resolution: 15 minutes
  • sf.org.num.awsServiceCallCount (gauge)
    Total number of calls made to the Amazon API.
    • Dimension(s): orgId, namespace (AWS service, such as AWS/Cloudwatch), method (the API being called, such as getMetricStatistics)
    • Data resolution: 5 seconds
  • sf.org.num.awsServiceCallCountExceptions (gauge)
    Number of calls made to the Amazon API that threw exceptions.
    • Dimension(s): orgId, namespace (AWS service, such as AWS/Cloudwatch), method (the API being called, such as getMetricStatistics), location (where the exception occurred, either client or server)
    • Data resolution: 5 seconds
  • sf.org.num.awsServiceCallThrottles (gauge)
    Number of calls made to the Amazon API that are being throttled by AWS because you have exceeded your AWS API Call limits.
    • Dimension(s): orgId, namespace (AWS service, such as AWS/Cloudwatch), method (the API being called, such as getMetricStatistics)
    • Data resolution: 5 seconds
  • sf.org.num.azureMonitorClientCallCount (gauge)
    Total number of calls made to the Amazon API.
    • Dimension(s): orgId, subscription_id, type (metric_data_sync for metric syncing and metric_metadata_sync for property syncing), method (the function being performed, getTimeseries for listing metrics and getMetricDefinition for listing out metric definitions)
    • Data resolution: 5 seconds
  • sf.org.num.azureMonitorClientCallCountErrors (counter)
    Number of calls to Azure Monitor API method that threw errors.
    • Dimension(s): orgId, subscription_id, type (metric_data_sync for metric syncing and metric_metadata_sync for property syncing), method (the function being performed, getTimeseries for listing metrics and getMetricDefinition for listing out metric definitions)
    • Data resolution: 1 second
  • sf.org.num.azureMonitorClientCallCountThrottles (counter)
    Number of calls to Azure Monitor method that were throttled.
    • Dimension(s): orgId, subscription_id, type (metric_data_sync for metric syncing and metric_metadata_sync for property syncing), method (the function being performed, getTimeseries for listing metrics and getMetricDefinition for listing out metric definitions)
    • Data resolution: 1 second
  • sf.org.num.chart (gauge)
    Total number of charts; includes any charts created using the Infrastructure Monitoring API but not associated with a dashboard.
    • Dimension(s): orgId
    • Data resolution: 15 minutes
  • sf.org.num.credentials (gauge)
    Total number of integrations that have been configured with credentials in Infrastructure Monitoring, for the purpose of retrieving metrics (example: AWS Cloudwatch) or sending alerts (example: PagerDuty).
    • Dimension(s): orgId
    • Data resolution: 15 minutes
  • sf.org.num.dashboard (gauge)
    Total number of dashboards; includes all user, custom, and built-in dashboards
    • Dimension(s): orgId
    • Data resolution: 15 minutes
  • sf.org.num.detector (gauge)
    Total number of detectors; includes detectors that are muted.
    • Dimension(s): orgId
    • Data resolution: 15 minutes
  • sf.org.num.detectortemplate (cumulative)
    sf.org.num.detectortemplate is reserved for Infrastructure Monitoring internal use only.
  • sf.org.num.dimension (gauge)
    Number of unique dimensions across all time series.
    • Dimension(s): orgId
    • Data resolution: 15 minutes
  • sf.org.num.eventtimeseries (gauge)
    Number of event time series (ETS) available to be visualized in charts and detectors.
    • Dimension(s): orgId
    • Data resolution: 15 minutes
  • sf.org.num.eventtype (gauge)
    Number of unique event types across all ETS.
    • Dimension(s): orgId
    • Data resolution: 15 minutes
  • sf.org.num.gcpStackdriverClientCallCount (counter)
    Number of calls to each Stackdriver client method.
    • Dimension(s): orgId, project_id, method (the API being called, such as getTimeSeries)
    • Data resolution: 1 second
  • sf.org.num.gcpStackdriverClientCallCountErrors (counter)
    Number of calls to each Stackdriver client method that threw errors.
    • Dimension(s): orgId, project_id, method (the API being called, such as getTimeSeries)
    • Data resolution: 1 second
  • sf.org.num.gcpStackdriverClientCallCountThrottles (counter)
    Number of calls to each Stackdriver client method that were throttled.
    • Dimension(s): orgId, project_id, method (the API being called, such as getTimeSeries)
    • Data resolution: 1 second
  • sf.org.num.metric (gauge)
    Number of unique metrics across all MTS.
    • Dimension(s): orgId
    • Data resolution: 15 minutes
  • sf.org.num.metrictimeseries (gauge)
    Number of metric time series (MTS) available to be visualized in charts and detectors.
    • Dimension(s): orgId
    • Data resolution: 15 minutes
  • sf.org.num.migrationmarker (gauge)
    Reserved for Infrastructure Monitoring internal use only.
  • sf.org.num.namedtoken (gauge)
    Number of organization access tokens, including disabled tokens.
    • Dimension(s): orgId
    • Data resolution: 15 minutes
  • sf.org.num.navigator (gauge)
    Number of options available in the sidebar in the Infrastructure Navigator.
    • Dimension(s): orgId
    • Data resolution: 15 minutes
  • sf.org.num.notifications (cumulative)
    Reserved for Infrastructure Monitoring internal use only.
  • sf.org.num.orgpreference (None)
    Reserved for Infrastructure Monitoring internal use only.
  • sf.org.num.orguser (gauge)
    Total number of members and admins associated with an organization; includes invited users who have not yet logged in.
    • Dimension(s): orgId
    • Data resolution: 15 minutes
  • sf.org.num.page (gauge)
    Total number of dashboard groups; includes user, custom, and built-in dashboard groups.
    • Dimension(s): orgId
    • Data resolution: 15 minutes
  • sf.org.num.property (gauge)
    Number of properties; includes only properties you have created, not dimensions. For the latter, use sf.org.num.dimension.
    • Dimension(s): orgId
    • Data resolution: 15 minutes
  • sf.org.num.service (None)
    Reserved for Infrastructure Monitoring internal use only.
  • sf.org.num.shareablesnapshot (None)
    Reserved for Infrastructure Monitoring internal use only.
  • sf.org.num.source (None)
    Reserved for Infrastructure Monitoring internal use only.
  • sf.org.num.tag (gauge)
    Number of tags available for use.
    • Dimension(s): orgId
    • Data resolution: 15 minutes
  • sf.org.num.team (gauge)
    Number of teams in the organization.
    • Dimension(s): orgId
    • Data resolution: 15 minutes
  • sf.org.num.teammember (gauge)
    Number of users that are members of teams; can be greater than the total number of users. For example, if team A has 30 members and team B has 20 members, the value is 50 even if there are only 30 members in the org.
    • Dimension(s): orgId
    • Data resolution: 15 minutes
  • sf.org.numActiveTimeSeries (gauge)
    Total number of metric time series (MTS) currently active in the organization. (Use sf.org.numInactiveTimeSeries to see how many MTS are not active.)
    • Dimension(s): orgId
    • Data resolution: 1 second
  • sf.org.numAddDatapointCalls (counter)
    Number of calls to send data points to Infrastructure Monitoring.
    • Dimension(s): orgId
    • Data resolution: 1 second
  • sf.org.numAddDatapointCallsByToken (counter)
    One value per token; number of calls to send data points to Infrastructure Monitoring. The sum of all the values might be less than the value of sf.org.numAddDatapointCalls. To learn more, see Metrics for values by token.
    • Dimension(s): orgId, tokenId
    • Data resolution: 1 second
  • sf.org.numAddEventsCalls (counter)
    Number of calls to send custom events to Infrastructure Monitoring.
    • Dimension(s): orgId
    • Data resolution: 1 second
  • sf.org.numAddEventsCallsByToken (counter)
    One value per token; number of calls to send custom events to Infrastructure Monitoring. The sum of all the values might be less than the value of sf.org.numAddEventsCalls. To learn more, see Metrics for values by token.
    • Dimension(s): orgId, tokenId
    • Data resolution: 1 second
  • sf.org.numBackfillCalls (counter)
    One value per metric type, each representing the number of times a backfill API call was used to send metrics to Infrastructure Monitoring. You can have up to three MTS for this metric; each MTS is sent with a dimension named category with a value of “counter”, “cumulative_counter”, or “gauge”. To learn more, see Metrics with values for each metric type.
    • Dimension(s): category, orgId
    • Data resolution: 1 second
  • sf.org.numBackfillCallsByToken (counter)
    One value per metric type per token, each representing the number of times a backfill API call was used to send metrics to Infrastructure Monitoring. You can have up to three MTS associated with each token; each MTS is sent with a dimension named category with a value of “counter”,”cumulative_counter”, or “gauge”. To learn more, see Metrics with values for each metric type. The sum of all the values might be less than the value of sf.org.numBackfillCalls. To learn more, see Metrics for values by token.
    • Dimension(s): category, orgId, tokenId
    • Data resolution: 1 second
  • sf.org.numCustomMetrics (counter)
    Number of custom metrics monitored by Infrastructure Monitoring.
    • Dimension(s): orgId
    • Data resolution: 10 minutes
  • sf.org.numCustomMetricsByToken (counter)
    One value per token; number of custom metrics monitored by Infrastructure Monitoring. The sum of all the values might be less than the value of sf.org.numCustomMetrics. To learn more, see Metrics for values by token.
    • Dimension(s): orgId, tokenId
    • Data resolution: 10 minutes
  • sf.org.numDatapointsBackfilled (counter)
    One value per metric type, each representing the number of data points that were sent using a backfill API. You can have up to three MTS for this metric; each MTS is sent with a dimension named category with a value of “counter”, “cumulative_counter”, or “gauge”. To learn more, see Metrics with values for each metric type.
    • Dimension(s): category, orgId
    • Data resolution: 1 second
  • sf.org.numDatapointsBackfilledByToken (counter)
    One value per metric type per token, each representing the number of data points that were sent using a backfill API. You can have up to three MTS for this metric; each MTS is sent with a dimension named category with a value of “counter”, “cumulative_counter”, or “gauge”. To learn more, see Metrics with values for each metric type. The sum of all the values might be less than the value of sf.org.numDatapointsBackfilled. To learn more, see Metrics for values by token.
    • Dimension(s): category, orgId, tokenId
    • Data resolution: 1 second
  • sf.org.numDatapointsDroppedExceededQuota (counter)
    Total number of new data points you sent to Infrastructure Monitoring but that Infrastructure Monitoring didn’t accept, because your organization exceeded its subscription limit. To learn more about the process Infrastructure Monitoring uses for incoming data when you exceed subscription limits, see this FAQ.
    • Dimension(s): orgId
    • Data resolution: 1 second
  • sf.org.numDatapointsDroppedExceededQuotaByToken (counter)
    One value per token; number of new data points you sent to Infrastructure Monitoring but that Infrastructure Monitoring didn’t accept, because your organization exceeded its subscription limit. To learn more about the process Infrastructure Monitoring uses for incoming data when you exceed subscription limits, see DPM Limits - FAQ. The sum of all the values might be less than the value of sf.org.numDatapointsDroppedExceededQuota. To learn more, see Metrics for values by token.
    • Dimension(s): orgId, tokenId
    • Data resolution: 1 second
  • sf.org.numDatapointsDroppedInTimeout (None)
    Reserved for Infrastructure Monitoring internal use only.
  • sf.org.numDatapointsDroppedInTimeoutByToken (None)
    Reserved for Infrastructure Monitoring internal use only.
  • sf.org.numDatapointsDroppedThrottle (counter)
    Total number of data points you sent to Infrastructure Monitoring that Infrastructure Monitoring didn’t accept because your organization significantly exceeded its DPM limit. For help with this issue, reach out to support at observability-support@splunk.com. Unlike sf.org.numDatapointsDroppedExceededQuota, this metric represents data points for both existing and new MTS. If Infrastructure Monitoring is throttling your organization, it isn’t keeping any of your data.
    • Dimension(s): orgId
    • Data resolution: 1 second
  • sf.org.numDatapointsDroppedThrottleByToken (counter)
    One value per token; number of data points you sent to Infrastructure Monitoring but that Infrastructure Monitoring didn’t accept because your organization significantly exceeded its DPM limit. For help with this issue, reach out to support at observability-support@splunk.com. Unlike sf.org.numDatapointsDroppedExceededQuota, this metric represents data points for both existing and new MTS. If Infrastructure Monitoring is throttling your organization, it isn’t keeping any of your data. The sum of all the values might be less than the value of sf.org.numDatapointsDroppedThrottle. To learn more, see Metrics for values by token.
    • Dimension(s): orgId, tokenId
    • Data resolution: 1 second
  • sf.org.numDatapointsReceived (counter)
    One value per metric type, each representing the number of data points that Infrastructure Monitoring received and processed. You can have up to three MTS for this metric; each MTS is sent with a dimension named category with a value of “counter”, “cumulative_counter”, or “gauge”. To learn more, see Metrics with values for each metric type. The sum of the values represents the total number of data points you sent to Infrastructure Monitoring minus any data points that weren’t accepted because you exceeded a limit.
    • Dimension(s): category, orgId
    • Data resolution: 1 second
  • sf.org.numDatapointsReceivedByToken (counter)
    One value per metric type per token, each representing the number of data points Infrastructure Monitoring received and processed. The sum of values for a token is the total number of data points you sent to Infrastructure Monitoring minus the number of data points that Infrastructure Monitoring didn’t accept because you exceeded a limit. You can have up to three MTS for this metric; each MTS is sent with a dimension named category with a value of “counter”, “cumulative_counter”, or “gauge”. To learn more, see Metrics with values for each metric type. The sum of all the values might be less than the value of sf.org.numDatapointsReceived. To learn more, see Metrics for values by token.
    • Dimension(s): category, orgId, tokenId
    • Data resolution: 1 second
  • sf.org.numDetectorsAborted (counter)
    Number of detector jobs stopped because they reached a resource limit (usually MTS limit).
    • Dimension(s): orgId
    • Data resolution: 5 seconds
  • sf.org.numEventsDroppedThrottle (counter)
    Number of custom events you sent to Infrastructure Monitoring but that Infrastructure Monitoring didn’t accept, because your organization exceeded its per-minute limit.
    • Dimension(s): orgId
    • Data resolution: 1 second
  • sf.org.numEventsDroppedThrottleByToken (counter)
    For each token, this is the number of custom events you sent to Infrastructure Monitoring but that Infrastructure Monitoring didn’t accept, because your organization significantly exceeded its per-minute limit. The sum of all the values might be less than the value of sf.org.numEventsDroppedThrottle. To learn more, see Metrics for values by token.
    • Dimension(s): orgId, tokenId
    • Data resolution: 1 second
  • sf.org.numEventsIngested (counter)
    Number of custom events received by Infrastructure Monitoring through the /event POST API.
    • Dimension(s): orgId, category
    • Data resolution: 1 second
  • sf.org.numEventsIngestedByToken (counter)
    For each token, this is the number of custom events sent by the POST /event operation. The sum of all the values might be less than the value of sf.org.numEventsIngested. To learn more, see Metrics with values for each metric type.
    • Dimension(s): orgId, tokenId, category
    • Data resolution: 1 second
  • sf.org.numEventsReceived (None)
    Reserved for Infrastructure Monitoring internal use only.
  • sf.org.numEventsReceivedByToken (None)
    Reserved for Infrastructure Monitoring internal use only.
  • sf.org.numEventTimeSeriesCreated (counter)
    Total number of event time series (ETS) created. For MTS values, see sf.org.numMetricTimeSeriesCreated.
    • Dimension(s): orgId
    • Data resolution: 1 second
  • sf.org.numEventTimeSeriesCreatedByToken (counter)
    One value per token; number of event time series (ETS) created. For MTS values, see sf.org.numMetricTimeSeriesCreatedByToken. The sum of all the values might be less than the value of sf.org.numEventTimeSeriesCreated. To learn more, see Metrics for values by token.
    • Dimension(s): orgId, tokenId
    • Data resolution: 1 second
  • sf.org.numHighResolutionMetrics (counter)
    Number of high resolution metrics monitored by Infrastructure Monitoring
    • Dimension(s): orgId
    • Data resolution: 10 minutes
  • sf.org.numHighResolutionMetricsByToken (counter)
    For each token, this is the number of high resolution metrics monitored by Infrastructure Monitoring. The sum of all the values might be less than the value of sf.org.numHighResolutionMetrics. To learn more, see Metrics for values by token.
    • Dimension(s): orgId, tokenId
    • Data resolution: 10 minutes
  • sf.org.numInactiveTimeSeries (gauge)
    Total number of previously active metric time series (MTS) that are no longer active. Use sf.org.numActiveTimeSeries to see how many MTS are active.
    • Dimension(s): orgId
    • Data resolution: 1 second
  • sf.org.numLimitedEventTimeSeriesCreateCalls (counter)
    Number of event time series (ETS) that Infrastructure Monitoring was unable to create because you exceeded the maximum number of ETS allowed.
    • Dimension(s): orgId
    • Data resolution: 1 second
  • sf.org.numLimitedEventTimeSeriesCreateCallsByToken (counter)
    One value per token, each representing the number of event time series (ETS) Infrastructure Monitoring was unable to create because you exceeded the maximum number of ETS allowed. The sum of all the values might be less than the value of sf.org.numLimitedEventTimeSeriesCreateCalls. To learn more, Metrics for values by token.
    • Dimension(s): category, orgId, tokenId
    • Data resolution: 1 second
  • sf.org.numLimitedMetricTimeSeriesCreateCalls (counter)
    One value per metric type, each representing the number of metric time series (MTS) not sent to Infrastructure Monitoring because you’ve reached your maximum active MTS allowed. You can have up to three MTS for this metric; each MTS is sent with a dimension named category with a value of “counter”, “cumulative_counter”, or “gauge”. To learn more, see Metrics with values for each metric type.
    • Dimension(s): category, orgId
    • Data resolution: 1 second
  • sf.org.numLimitedMetricTimeSeriesCreateCallsByToken (counter)
    One value per metric type per token, each representing the number of metric time series (MTS) not sent to Infrastructure Monitoring because you’ve reached your maximum active MTS allowed. You can have up to three MTS for this metric; each MTS is sent with a dimension named category with a value of “counter”, “cumulative_counter”, or “gauge”. To learn more, see Metrics with values for each metric type. The sum of all the values might be less than the value of sf.org.numLimitedMetricTimeSeriesCreateCalls. To learn more, see Metrics for values by token.
    • Dimension(s): category, orgId, tokenId
    • Data resolution: 1 second
  • sf.org.numMappingsAdded (None)
    Reserved for Infrastructure Monitoring internal use only.
  • sf.org.numMappingsAddedByToken (None)
    Reserved for Infrastructure Monitoring internal use only.
  • sf.org.numMetadataWrites (None)
    Reserved for Infrastructure Monitoring internal use only.
  • sf.org.numMetadataWritesByToken (None)
    Reserved for Infrastructure Monitoring internal use only.
  • sf.org.numMetadataWritesThrottled (None)
    Reserved for Infrastructure Monitoring internal use only.
  • sf.org.numMetadataWrttesThrottledByToken (None)
    Reserved for Infrastructure Monitoring internal use only.
  • sf.org.numMetricTimeSeriesCreated (counter)
    One value per metric type, each representing the number of metric time series (MTS) created that have that type. You can have up to three MTS for this metric; each MTS is sent with a dimension named category with a value of “counter”, “cumulative_counter”, or “gauge”. To learn more, see Metrics with values for each metric type.
    • Dimension(s): category, orgId
    • Data resolution: 5 seconds
  • sf.org.numMetricTimeSeriesCreatedByToken (counter)
    One value per metric type per token, each representing the number of metric time series (MTS) created that have that type. You can have up to three MTS for this metric; each MTS is sent with a dimension named category with a value of “counter”, “cumulative_counter”, or “gauge”. To learn more, see Metrics with values for each metric type. The sum of all the values might be less than the value of sf.org.numMetricTimeSeriesCreated. To learn more, see Metrics for values by token.
    • Dimension(s): category, orgId, tokenId
    • Data resolution: 5 seconds
  • sf.org.numNewDimensions (counter)
    The number of new dimensions (key:value pairs) created.
    • Data resolution: 5 minutes
  • sf.org.numNewDimensionsByName (counter)
    The number of new dimensions created for each unique dimension name (key from key:value pair). Only the top 100 dimension names (by number of dimensions created) are included, in addition to dimension name sf_metric, which is always included.
    • Data resolution: 5 minutes
  • sf.org.numPropertyLimitedMetricTimeSeriesCreateCalls (counter)
    Number of metric time series (MTS) Infrastructure Monitoring was unable to create because you reached your maximum number of unique dimension names.
    • Dimension(s): orgId
    • Data resolution: 1 second
  • sf.org.numPropertyLimitedMetricTimeSeriesCreateCallsByToken (counter)
    One value per token; number of metric time series (MTS) Infrastructure Monitoring was unable to create because you reached your maximum number of unique dimension names. The sum of all the values might be less than the value of sf.org.numPropertyLimitedMetricTimeSeriesCreateCalls. To learn more, see Metrics for values by token.
    • Dimension(s): orgId, tokenId
    • Data resolution: 1 second
  • sf.org.numResourcesMonitored (counter)
    Number of hosts or containers that Infrastructure Monitoring is currently monitoring. The resourceType dimension indicates whether the value represents hosts or containers.
    • Dimension(s): orgId, resourceType
    • Data resolution: 10 minutes
  • sf.org.numResourcesMonitoredByToken (counter)
    One value per token; number of hosts or containers that Infrastructure Monitoring is monitoring. This metric isn’t created until a host or container starts sending a host or container metric. The resourceType dimension indicates whether the value represents hosts or containers. The sum of all the values might be less than the value of sf.org.numResourcesMonitored. To learn more, see Metrics for values by token.
    • Dimension(s): orgId, resourceType, tokenId`
    • Data resolution: 10 minutes
  • sf.org.numRestCalls (counter)
    Number of REST calls made to the Infrastructure Monitoring API.
    • Dimension(s): orgId
    • Data resolution: 1 second”
  • sf.org.numRestCallsByToken (counter)
    For each token, the number of REST calls made to the Infrastructure Monitoring API. The sum of all the values might be less than the value of sf.org.numRestCalls. To learn more, see Metrics for values by token.
    • Dimension(s): orgId, tokenId
    • Data resolution: 1 second
  • sf.org.numRestCallsThrottled (counter)
    Number of REST calls you made to the Infrastructure Monitoring API that were not accepted by Infrastructure Monitoring, because your organization significantly exceeded its per-minute limit.
    • Dimension(s): orgId
    • Data resolution: 1 second
  • sf.org.numRestCallsThrottledByToken (counter)
    For each token, the number of REST calls you made to the Infrastructure Monitoring API that were not accepted by Infrastructure Monitoring because your organization significantly exceeded its per-minute limit. The sum of all the values might be less than the value of sf.org.numRestCallsThrottled. To learn more, see Metrics for values by token.
    • Dimension(s): orgId, tokenId
    • Data resolution: 1 second
  • sf.org.numThrottledEventTimeSeriesCreateCalls (counter)
    Total number of event time series (ETS) that Infrastructure Monitoring was unable to create, because you significantly exceeded your per-minute event creation limit.
    • Dimension(s): orgId
    • Data resolution: 1 second
  • sf.org.numThrottledEventTimeSeriesCreateCallsByToken (counter)
    For each token, the number of event time series (ETS) that Infrastructure Monitoring was unable to create because you significantly exceeded your per-minute event creation limit. The sum of all the values might be less than the value of sf.org.numThrottledEventTimeSeriesCreateCalls. To learn more, see Metrics for values by token.
    • Dimension(s): orgId, tokenId
    • Data resolution: 1 second
  • sf.org.numThrottledMetricTimeSeriesCreateCalls (counter)
    Number of metric time series (MTS) that Infrastructure Monitoring was unable to create because you significantly exceeded your per-minute or per-hour MTS creation limit.
    • Dimension(s): orgId
    • Data resolution: 1 second
  • sf.org.numThrottledMetricTimeSeriesCreateCallsByToken (counter)
    For each token, the number of metric time series (MTS) Infrastructure Monitoring was unable to create because your organization significantly exceeded its per-minute or per-hour MTS creation limit. The sum of all the values might be less than the value of sf.org.numThrottledMetricTimeSeriesCreateCalls. To learn more, see [Metrics for values by token](#metrics for values by token).
    • Dimension(s): orgId, tokenId
    • Data resolution: 1 second
  • sf.org.numUniqueNamesInNewDimensions (counter)
    The number of unique dimension names (keys) created in all new dimensions
    • Data resolution: 5 minutes
  • sf.org.subscription.activeTimeSeries (gauge)
    Maximum number of active metric time series (MTS).
    • Data resolution: 15 minutes
  • sf.org.subscription.datapointsPerMinute (gauge)
    Maximum number of data points per minute (DPM) that Infrastructure Monitoring will process and store.
    • Data resolution: 15 minutes
  • sf.org.ui.num.pagevisits (None)
    Reserved for Infrastructure Monitoring internal use only.