---
title: "Chapter 41 Reporting Data Model"
canonical: "https://docs.infoblox.com/space/NAG8/22249691/Chapter%2041%20Reporting%20Data%20Model"
format: markdown
---
<span style="color: #333333">This section contains information about fields that are included in the reports and dashboards. You can find the commonly extracted fields and their specifications such as data source and range, which can help you better define your dashboards and searches.</span>

# Splunk Default Fields

<span style="color: #333333">Splunk server adds the following default fields to each event in every index.</span>

|  |  |  |
| --- | --- | --- |
| **<span style="color: #333333">Field Name</span>** | **<span style="color: #333333">Description</span>** | **<span style="color: #333333">Values/Range</span>** |
| > Macro (anchor)

<span style="color: #808284">date_hour</span> | <span style="color: #808284">Indicates the hour when an event occurred. To narrow your search for specific event timestamps, you can use the default datetime fields. Click</span> <span style="color: #0000ff">[<u>here</u>](http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/Usedefaultfields)</span><span style="color: #0000ff"><u> </u></span><span style="color: #808284">for more information on datetime fields.</span> | <span style="color: #808284">Range: 0-23</span> |
| > Macro (anchor)

<span style="color: #808284">date_mday</span> | <span style="color: #808284">Indicates the day of the month when the event occurred</span> | <span style="color: #808284">Range: 1-31</span> |
| > Macro (anchor)

 <span style="color: #808284">date_minute</span> | <span style="color: #808284">Indicates the exact minute when the event occurred</span> | <span style="color: #808284">Range: 0-59</span> |
| > Macro (anchor)

<span style="color: #808284">date_month</span> | <span style="color: #808284">Indicates the month during which an event occurred</span> |  |
| > Macro (anchor)

<span style="color: #808284">date_second</span> | <span style="color: #808284">Indicates the second in which an event occurred</span> | <span style="color: #808284">Range: 0-59</span> |
| > Macro (anchor)

<span style="color: #808284">date_wday</span> | <span style="color: #808284">Indicates the day of the week in which an event occurred</span> | <span style="color: #808284">Example: Sunday, Monday, etc.</span> |
| > Macro (anchor)

<span style="color: #808284">date_year</span> | <span style="color: #808284">Indicates the year in which an event occurred</span> |  |
| > Macro (anchor)

<span style="color: #808284">date_zone</span> | <span style="color: #808284">Indicates the time for the local timezone of an event, expressed as hours in Unix Time</span> |  |
| > Macro (anchor)

<span style="color: #808284">eventtype</span> | <span style="color: #808284">Indicates events of the same type based on a given search. Click </span><span style="color: #0000ff">[here](http://docs.splunk.com/Documentation/SplunkCloud/6.5.1/Knowledge/Configureeventtypes)</span> <span style="color: #808284">for more information</span> | <span style="color: #808284">Example: splunkd-log</span> |
| > Macro (anchor)

<span style="color: #808284">host</span> | <span style="color: #808284">Contains information about the originating hostname or a network IP address that generates the event</span> | <span style="color: #808284">Example: reporting-1.com</span> |
| > Macro (anchor)

<span style="color: #808284">index</span> | <span style="color: #808284">Contains the name of the index with which a given event is indexed</span> | <span style="color: #808284">Example: ib_dns_summary</span> |
| > Macro (anchor)

<span style="color: #808284">linecount</span> | <span style="color: #808284">Contains information about the number of lines in an event before it is indexed</span> | <span style="color: #808284">Example: 1</span> |
| > Macro (anchor)

<span style="color: #808284">punct</span> | <span style="color: #808284">Contains information about the pattern of the first thirty punctuation characters in the first line of the event with which it is associated. It shows how an event looks when all letters, numbers, and spaces are removed and contains characters such as periods, colons, parentheses, quotes, question marks, dashes, and underscores. Click </span><span style="color: #808284">[here](https://docs.splunk.com/Splexicon:Punct)</span><span style="color: #808284"> for more information.</span> | > Macro (unmigrated-wiki-markup) |
| > Macro (anchor)

<span style="color: #808284">source</span> | <span style="color: #808284">Contains the name of the file, stream, or other input details from which the event originates</span> | <span style="color: #808284">Example: si-search-dns-query-reply</span> |
| > Macro (anchor)

<span style="color: #808284">sourcetype</span> | <span style="color: #808284">Specifies the format of data input from which the event originates</span> | <span style="color: #808284">Stash</span> |
| > Macro (anchor)

<span style="color: #808284">splunk_server</span> | <span style="color: #808284">Contains the name of the Splunk server that comprises the event</span> | <span style="color: #808284">Example: reporting-2.com-2-<</span>*<span style="color: #808284">secondary_server</span>*<span style="color: #808284">></span> |
| > Macro (anchor)

<span style="color: #808284">splunk_server_group</span> | <span style="color: #808284">Contains the name of the Splunk server group</span> | <span style="color: #808284">String</span> |


# > Macro (anchor)

Commonly extracted fields


|  |  |  |  |
| --- | --- | --- | --- |
| **<span style="color: #333333">Field Name</span>** | **<span style="color: #333333">Description</span>** | **<span style="color: #333333">Values/Range</span>** | **Source of Data** |
| > Macro (anchor)

<span style="color: #808284">EA</span> | <span style="color: #808284">Specifies the extensible attribute</span> | <span style="color: #808284">String</span> | **__grouping_by_ea_tag_lookup** lookup   
from **/storage/splunk/etc/apps/infoblox**  
**/lookups/grouping_by_ea_tag_map.csv** with   
**host** value as input  
**OR**  
**pool_ea_lookup_csv** lookup from   
**/storage/splunk/etc/apps/infoblox/**  
**lookups/idns_pools.csv** with **pool** value   
as input  
**OR**  
**resource_pool_ea_lookup_csv** lookup   
from **/storage/splunk/etc/apps/infoblox**  
**/lookups/idns_resources.csv** with   
**RESOURCE** value as input  
**OR**  
**network_ea_lookup_csv** lookup   
from **/storage/splunk/etc/apps**  
**/infoblox/lookups/network.csv**   
with **NETWORK** value as input |
| > Macro (anchor)

<span style="color: #808284">HWTYPE</span> | <span style="color: #808284">Specifies the hardware type</span> | <span style="color: #808284">Example: IB-4030</span> | **nios_member_hw_lookup **lookup from   
**/storage/splunk/etc/apps/infoblox/**  
**lookups/nios_member_hw.csv** with   
**host** value as input |
| > Macro (anchor)

<span style="color: #808284">MAX_DB_OBJECTS</span> | <span style="color: #808284">Specifies the maximum objects in the database for a host</span> | <span style="color: #808284">eg: 8000000</span> | **nios_member_hw_lookup **lookup from   
**/storage/splunk/etc/apps/infoblox/**  
**lookups/nios_member_hw.csv** with   
**host** value as input |
| > Macro (anchor)

<span style="color: #808284">MAX_DHCP_LPS</span> | <span style="color: #808284">Specifies the maximum number of DHCP leases per second for a host</span> | <span style="color: #808284">Example: 15.0</span> | **nios_member_hw_lookup **lookup from   
**/storage/splunk/etc/apps/infoblox/**  
**lookups/nios_member_hw.csv** with   
**host** value as input |
| > Macro (anchor)

<span style="color: #808284">MAX_DNS_QPS</span> | <span style="color: #808284">Specifies the maximum DNS queries per second for a host</span> | <span style="color: #808284">Example: 1000000.0</span> | **nios_member_hw_lookup **lookup from   
**/storage/splunk/etc/apps/infoblox/**  
**lookups/nios_member_hw.csv** with   
**host** value as input |
| > Macro (anchor)

<span style="color: #808284">MEMBER_IP</span> | <span style="color: #808284">Specifies the IP address of the member</span> | <span style="color: #808284">IP address</span> | **nios_member_hw_lookup **lookup from   
**/storage/splunk/etc/apps/infoblox/**  
**lookups/nios_member_ip.csv** with   
**host** value as input |
| > Macro (anchor)

<span style="color: #808284">timeendpos</span> | <span style="color: #808284">Specifies the byte at which the timestamp ends. These values are based on the TIME_FORMAT that is specified for a sourcetype under props.conf.</span> | <span style="color: #808284">Example: 26</span> |  |
| > Macro (anchor)

<span style="color: #808284">timestartpos</span> | <span style="color: #808284">Specifies the byte at which the timestamp starts</span> | <span style="color: #808284">Example: 0</span> |  |

# Indexes and Extracted Data

## Infoblox Audit Logs

Most of the fields in this index are extracted directly from the **audit.log** file. Some of them are mentioned in the table below:

|  |  |  |  |
| --- | --- | --- | --- |
| **Extracted Field Name** | **Description of the field** | **Values/Range** | **Source of Data** |
| <span style="color: #808284">ACTION</span> | <span style="color: #808284">Indicates the action taken</span> | <span style="color: #808284">String. Example: Called</span> | <span style="color: #808284">Infoblox audit logs</span> |
| <span style="color: #808284">ADMIN</span> | <span style="color: #808284">Indicates the name of the admin</span> | <span style="color: #808284">String. Example: root</span> | <span style="color: #808284">Infoblox audit logs</span> |
| <span style="color: #808284">EA</span> | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-EA)</span> |  |  |
| <span style="color: #808284">EXEC_STATUS</span> | <span style="color: #808284">Indicates the execution status</span> | <span style="color: #808284">String. Example: Pending Approval</span> | <span style="color: #808284">Infoblox audit logs</span> |
| <span style="color: #808284">HWTYPE</span> | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-HWTYPE)</span> |  |  |
| <span style="color: #808284">MAX_DB_OBJECTS</span> | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DB_OBJECTS)</span> |  |  |
| <span style="color: #808284">MAX_DHCP_LPS</span> | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DHCP_LPS)</span> |  |  |
| <span style="color: #808284">MAX_DNS_QPS</span> | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DNS_QPS)</span> |  |  |
| <span style="color: #808284">MEMBER_IP</span> | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MEMBER_IP)</span> |  |  |
| <span style="color: #808284">MESSAGE</span> | <span style="color: #808284">Indicates the message</span> | <span style="color: #808284">String. Example: to=Serial</span>  
<span style="color: #808284">040Console apparently_via=Direct auth=Local group=.admin-group</span> | <span style="color: #808284">Infoblox audit logs</span> |
| <span style="color: #808284">OBJECT_NAME</span> | <span style="color: #808284">Indicates the object name</span> | <span style="color: #808284">String. Example: RequestRestartServiceStatus</span> | <span style="color: #808284">Infoblox audit logs</span> |
| <span style="color: #808284">OBJECT_TYPE</span> | <span style="color: #808284">Indicates the object type</span> | <span style="color: #808284">String. Example: Shared AAAA Record</span> | <span style="color: #808284">Infoblox audit logs</span> |
| <span style="color: #808284">TIMESTAMP</span> | <span style="color: #808284">Indicates the timestamp</span> | <span style="color: #808284">Timestamp. Example: 2017-01-31 01:57:05</span> | <span style="color: #808284">Infoblox audit logs</span> |
| <span style="color: #808284">action</span> | <span style="color: #808284">Indicates the action</span> | <span style="color: #808284">Example: update, insert</span> | <span style="color: #808284">Infoblox audit logs</span> |
| <span style="color: #808284">address</span> |  | <span style="color: #808284">Example: 10.0.0.0</span> | <span style="color: #808284">Infoblox audit logs</span> |
| <span style="color: #808284">auth</span> |  | <span style="color: #808284">Example: Local</span> | <span style="color: #808284">Infoblox audit logs</span> |
| <span style="color: #808284">cidr</span> |  | <span style="color: #808284">Example: 8</span> | <span style="color: #808284">Infoblox audit logs</span> |
| <span style="color: #808284">code</span> |  | <span style="color: #808284">Example: created</span> | <span style="color: #808284">Infoblox audit logs</span> |
| <span style="color: #808284">comment</span> |  | <span style="color: #808284">String</span> | <span style="color: #808284">Infoblox audit logs</span> |
| <span style="color: #808284">date_hour</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_hour)</span> |  |  |
| <span style="color: #808284">date_mday</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_mday)</span> |  |  |
| <span style="color: #808284">date_minute</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_minute)</span> |  |  |
| <span style="color: #808284">date_month</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_month)</span> |  |  |
| <span style="color: #808284">date_second</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_second)</span> |  |  |
| <span style="color: #808284">date_wday</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_wday)</span> |  |  |
| <span style="color: #808284">date_year</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_year)</span> |  |  |
| <span style="color: #808284">date_zone</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_zone)</span> |  |  |
| <span style="color: #808284">eventtype</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-eventtype)</span> |  |  |
| <span style="color: #808284">group</span> |  | <span style="color: #808284">Example: admin-group</span> | <span style="color: #808284">Infoblox audit logs</span> |
| <span style="color: #808284">host</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-host)</span> |  |  |
| <span style="color: #808284">index</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-index)</span> |  |  |
| <span style="color: #808284">linecount</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-linecount)</span> |  |  |
| <span style="color: #808284">member</span> |  | <span style="color: #808284">Example: Member:infoblox.localdomain</span> | <span style="color: #808284">Infoblox audit logs</span> |
| <span style="color: #808284">network_view</span> |  | <span style="color: #808284">Example: default</span> | <span style="color: #808284">Infoblox audit logs</span> |
| <span style="color: #808284">punct</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-punct)</span> |  |  |
| <span style="color: #808284">source</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-source)</span> |  |  |
| <span style="color: #808284">sourcetype</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-sourcetype)</span> |  |  |
| <span style="color: #808284">splunk_server</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server)</span> |  |  |
| <span style="color: #808284">splunk_server_group</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server_group)</span> |  |  |
| <span style="color: #808284">user</span> |  | <span style="color: #808284">Example: admin</span> | <span style="color: #808284">Infoblox audit logs</span> |

## Infoblox DNS Query, DNS Performance, DDNS, DNS Record Scavenging

|  |  |  |  |
| --- | --- | --- | --- |
| **Extracted Field Name** | **Description of the field** | **Values/Range** | **Source of Data** |
| <span style="color: #808284">CLIENT</span> | <span style="color: #808284">Indicates the DNS client</span> | <span style="color: #808284">String</span> | <span style="color: #808284">Infoblox DNS query</span> |
| > Macro (anchor)

<span style="color: #808284">COUNT</span> | <span style="color: #808284">Indicates the count</span> | <span style="color: #808284">Integer</span> | <span style="color: #808284">Infoblox DNS query and DNS Record Scavenging</span> |
| <span style="color: #808284">EA</span> | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-EA)</span> |  |  |
| <span style="color: #808284">FQDN</span> | <span style="color: #808284">Indicates the FQDN</span> | <span style="color: #808284">String</span> | <span style="color: #808284">Infoblox DNS query</span> |
| <span style="color: #808284">HITS</span> | <span style="color: #808284">Indicates the DNS cache hits count</span> | <span style="color: #808284">Integer</span> | <span style="color: #808284">Infoblox DNS query</span> |
| <span style="color: #808284">HNAME</span> | <span style="color: #808284">Indicates the HNAME</span> | <span style="color: #808284">String</span> | <span style="color: #808284">Infoblox DNS query</span> |
| <span style="color: #808284">HWTYPE</span> | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-HWTYPE)</span> |  |  |
| > Macro (anchor)

<span style="color: #808284">LATENCY</span> | <span style="color: #808284">Indicates the latency count</span> | <span style="color: #808284">Integer</span> | <span style="color: #808284">Infoblox DNS performance</span> |
| <span style="color: #808284">MAX_DB_OBJECTS</span> | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DB_OBJECTS)</span> |  |  |
| <span style="color: #808284">MAX_DHCP_LPS</span> | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DHCP_LPS)</span> |  |  |
| <span style="color: #808284">MAX_DNS_QPS</span> | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DNS_QPS)</span> |  |  |
| <span style="color: #808284">MEMBER</span> | <span style="color: #808284">Specifies the member</span> | <span style="color: #808284">String</span> | <span style="color: #808284">DNS Record Scavenging</span> |
| <span style="color: #808284">MEMBER_IP</span> | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MEMBER_IP)</span> |  |  |
| <span style="color: #808284">MISSES</span> | <span style="color: #808284">Specifies DNS cache miss count</span> | <span style="color: #808284">Integer</span> | <span style="color: #808284">Infoblox DNS query</span> |
| > Macro (anchor)

<span style="color: #808284">QCOUNT</span> | <span style="color: #808284">Specifies query count</span> | <span style="color: #808284">Integer</span> | <span style="color: #808284">Infoblox DNS query</span> |
| <span style="color: #808284">REST</span> | <span style="color: #808284">REST</span> | <span style="color: #808284">String</span> | <span style="color: #808284">Infoblox DDNS</span> |
| <span style="color: #808284">SOURCE</span> | <span style="color: #808284">SOURCE</span> | <span style="color: #808284">String</span> | <span style="color: #808284">Infoblox DDNS</span> |
| <span style="color: #808284">SOURCEA</span> | <span style="color: #808284">SOURCEA</span> | <span style="color: #808284">IP address</span> | <span style="color: #808284">Infoblox DDNS</span> |
| <span style="color: #808284">TLD</span> | <span style="color: #808284">Specifies the top-level domain name</span> | <span style="color: #808284">String</span> | <span style="color: #808284">Infoblox DNS query</span> |
| <span style="color: #808284">TYPE</span> | <span style="color: #808284">RR Type</span> | <span style="color: #808284">String. Example: nxdomain</span> | <span style="color: #808284">Infoblox DNS query and DNS Record Scavenging</span> |
| <span style="color: #808284">TYPEA</span> | <span style="color: #808284">TYPEA</span> | <span style="color: #808284">String. Example: Success</span> | <span style="color: #808284">Infoblox DDNS</span> |
| <span style="color: #808284">VIEW</span> | <span style="color: #808284">It refers to the DNS view key to map DNS view through lookup. See</span> <span style="color: #0000ff">display_name</span> <span style="color: #808284">field</span>. | <span style="color: #808284">String</span> | <span style="color: #808284">Infoblox DNS query</span> |
| <span style="color: #808284">ZONE</span> | <span style="color: #808284">Indicates the name of the zone</span> | <span style="color: #808284">String</span> | <span style="color: #808284">Infoblox DDNS</span> |
| <span style="color: #808284">date_hour</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_hour)</span> |  |  |
| <span style="color: #808284">date_mday</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_mday)</span> |  |  |
| <span style="color: #808284">date_minute</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_minute)</span> |  |  |
| <span style="color: #808284">date_month</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_month)</span> |  |  |
| <span style="color: #808284">date_second</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_second)</span> |  |  |
| <span style="color: #808284">date_wday</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_wday)</span> |  |  |
| <span style="color: #808284">date_year</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_year)</span> |  |  |
| <span style="color: #808284">date_zone</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_zone)</span> |  |  |
| > Macro (anchor)

<span style="color: #808284">display_name</span> | <span style="color: #808284">Specifies the name of the DNS view</span> | <span style="color: #808284">String</span> | **<span style="color: #808284">DNS view lookup</span>**<span style="color: #808284"> from </span>**<span style="color: #808284">dns_viewkey_displayname.csv</span>**<span style="color: #808284"> using </span>**<span style="color: #808284">View</span>**<span style="color: #808284"> field value.</span> |
| <span style="color: #808284">eventtype</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-eventtype)</span> |  |  |
| <span style="color: #808284">failure</span> | <span style="color: #808284">Specifies the DNS FAILURE query count</span> | <span style="color: #808284">Integer</span> |  |
| <span style="color: #808284">host</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-host)</span> |  |  |
| <span style="color: #808284">index</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-index)</span> |  |  |
| <span style="color: #808284">linecount</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-linecount)</span> |  |  |
| <span style="color: #808284">nxdomain</span> | <span style="color: #808284">Specifies the DNS NXDOMAIN query count</span> | <span style="color: #808284">Integer</span> |  |
| <span style="color: #808284">nxrrset</span> | <span style="color: #808284">Specifies the DNS NXRRSET query count</span> | <span style="color: #808284">Integer</span> |  |
| <span style="color: #808284">other</span> | <span style="color: #808284">Specifies the DNS other query count</span> | <span style="color: #808284">Integer</span> |  |
| <span style="color: #808284">punct</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-punct)</span> |  |  |
| <span style="color: #808284">referral</span> | <span style="color: #808284">Specifies the DNS REFERRAL query count</span> | <span style="color: #808284">Integer</span> |  |
| <span style="color: #808284">source</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-source)</span> |  |  |
| <span style="color: #808284">sourcetype</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-sourcetype)</span> |  |  |
| <span style="color: #808284">splunk_server</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server)</span> |  |  |
| <span style="color: #808284">splunk_server_group</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server_group)</span> |  |  |
| <span style="color: #808284">success</span> | <span style="color: #808284">Specifies the DNS success query count</span> |  |  |
| <span style="color: #808284">timeendpos</span> | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timeendpos)</span> |  |  |
| <span style="color: #808284">timestartpos</span> | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timestartpos)</span> |  |  |

## Infoblox DNS Query Capture

|  |  |  |  |
| --- | --- | --- | --- |
| **Extracted Field Name** | **Description of the field** | **Values/Range** | **Source of Data** |
| <span style="color: #808284">EA</span> | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-EA)</span> |  |  |
| <span style="color: #808284">HWTYPE</span> | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-HWTYPE)</span> |  |  |
| <span style="color: #808284">MAX_DB_OBJECTS</span> | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DB_OBJECTS)</span> |  |  |
| <span style="color: #808284">MAX_DHCP_LPS</span> | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DHCP_LPS)</span> |  |  |
| <span style="color: #808284">MAX_DNS_QPS</span> | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DNS_QPS)</span> |  |  |
| <span style="color: #808284">MEMBER_IP</span> | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MEMBER_IP)</span> |  |  |
| <span style="color: #808284">answer_count</span> | <span style="color: #808284">Specifies the answer count</span> | <span style="color: #808284">Integer</span> | <span style="color: #808284">Infoblox DNS query capture</span> |
| <span style="color: #808284">date_hour</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_hour)</span> |  |  |
| <span style="color: #808284">date_mday</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_mday)</span> |  |  |
| <span style="color: #808284">date_minute</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_minute)</span> |  |  |
| <span style="color: #808284">date_month</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_month)</span> |  |  |
| <span style="color: #808284">date_second</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_second)</span> |  |  |
| <span style="color: #808284">date_wday</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_wday)</span> |  |  |
| <span style="color: #808284">date_year</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_year)</span> |  |  |
| <span style="color: #808284">date_zone</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_zone)</span> |  |  |
| <span style="color: #808284">display_name</span> | <span style="color: #808284">Specifies the DNS view</span> | <span style="color: #808284">String</span> | **<span style="color: #808284">DNS view lookup</span>**<span style="color: #808284"> from </span>**<span style="color: #808284">dns_viewkey_displayname.csv</span>**<span style="color: #808284"> using </span>**<span style="color: #808284">View</span>**<span style="color: #808284"> field value.</span> |
| <span style="color: #808284">eventtype</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-eventtype)</span> |  |  |
| <span style="color: #808284">flag_aa</span> | <span style="color: #808284">Flag AA</span> | <span style="color: #808284">Boolean. Example: Y</span> | <span style="color: #808284">Infoblox DNS query capture</span> |
| <span style="color: #808284">flag_ad</span> | <span style="color: #808284">Flag AD</span> | <span style="color: #808284">Boolean. Example: Y</span> | <span style="color: #808284">Infoblox DNS query capture</span> |
| <span style="color: #808284">flag_edns</span> | <span style="color: #808284">Flag EDNS</span> | <span style="color: #808284">Boolean. Example: Y</span> | <span style="color: #808284">Infoblox DNS query capture</span> |
| <span style="color: #808284">flag_recursion</span> | <span style="color: #808284">Flag Recursion</span> | <span style="color: #808284">Boolean. Example: Y</span> | <span style="color: #808284">Infoblox DNS query capture</span> |
| <span style="color: #808284">host</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-host)</span> |  |  |
| <span style="color: #808284">host_class</span> | <span style="color: #808284">Specifies the host class</span> | <span style="color: #808284">Example: IN</span> | <span style="color: #808284">Infoblox DNS query capture</span> |
| <span style="color: #808284">host_type</span> | <span style="color: #808284">Specifies the host type</span> | <span style="color: #808284">Example: PTR</span> | <span style="color: #808284">Infoblox DNS query capture</span> |
| <span style="color: #808284">index</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-index)</span> |  |  |
| <span style="color: #808284">linecount</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-linecount)</span> |  |  |
| <span style="color: #808284">message_type</span> | <span style="color: #808284">Specifies the message type</span> | <span style="color: #808284">Example: Query or Response</span> | <span style="color: #808284">Infoblox DNS query capture</span> |
| <span style="color: #808284">name</span> | <span style="color: #808284">Specifies the name</span> | <span style="color: #808284">Host name. Example: 1.0.0.127.in-addr.arpa</span> | <span style="color: #808284">Infoblox DNS query capture</span> |
| <span style="color: #808284">query</span> | <span style="color: #808284">Specifies the query</span> | <span style="color: #808284">Host name. Example: 213.31.102.10.in-addr.arpa</span> | <span style="color: #808284">Infoblox DNS query capture</span> |
| <span style="color: #808284">query_class</span> | <span style="color: #808284">Specifies the query class</span> | <span style="color: #808284">Example: IN</span> | <span style="color: #808284">Infoblox DNS query capture</span> |
| <span style="color: #808284">query_count</span> | <span style="color: #808284">Specifies the query count</span> | <span style="color: #808284">Integer. Example: 1</span> | <span style="color: #808284">Infoblox DNS query capture</span> |
| <span style="color: #808284">query_source</span> | <span style="color: #808284">Specifies the query source</span> | <span style="color: #808284">Example: I, E</span> | <span style="color: #808284">Infoblox DNS query capture</span> |
| <span style="color: #808284">query_type</span> | <span style="color: #808284">Specifies the DNS query type</span> | <span style="color: #808284">Example: PTR</span> | <span style="color: #808284">Infoblox DNS query capture</span> |
| <span style="color: #808284">rdata</span> | <span style="color: #808284">RDATA</span> | <span style="color: #808284">String. This value depends on the query type.</span> | <span style="color: #808284">Infoblox DNS query capture</span> |
| <span style="color: #808284">reply_code</span> | <span style="color: #808284">Specifies the reply code</span> | <span style="color: #808284">String. Example: ServFail, NoError</span> | <span style="color: #808284">Infoblox DNS query capture</span> |
| <span style="color: #808284">source</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-source)</span> |  |  |
| <span style="color: #808284">sourcetype</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-sourcetype)</span> |  |  |
| <span style="color: #808284">splunk_server</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server)</span> |  |  |
| <span style="color: #808284">splunk_server_group</span> | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server_group)</span> |  |  |
| <span style="color: #808284">src_ip</span> | <span style="color: #808284">Specifies the source IP</span> | <span style="color: #808284">IP Address</span> | <span style="color: #808284">Infoblox DNS query capture</span> |
| <span style="color: #808284">src_port</span> | <span style="color: #808284">Specifies the source port</span> | <span style="color: #808284">Integer</span> | <span style="color: #808284">Infoblox DNS query capture</span> |
| <span style="color: #808284">time_msec</span> | <span style="color: #808284">Specifies time in milliseconds</span> | <span style="color: #808284">Integer</span> | <span style="color: #808284">Infoblox DNS query capture</span> |
| <span style="color: #808284">timeendpos</span> | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timeendpos)</span> |  |  |
| <span style="color: #808284">timestamp</span> | <span style="color: #808284">Indicates the timestamp</span> | <span style="color: #808284">Integer</span> | <span style="color: #808284">Infoblox DNS query capture</span> |
| <span style="color: #808284">timestartpos</span> | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-timestartpos)</span> |  |  |
| <span style="color: #808284">transport</span> | <span style="color: #808284">Specifies the mode of transport</span> | <span style="color: #808284">Example: UDP, TCP</span> | <span style="color: #808284">Infoblox DNS query capture</span> |
| <span style="color: #808284">ttl</span> | <span style="color: #808284">Specifies the TTL</span> | <span style="color: #808284">Integer. Example: 3600</span> | <span style="color: #808284">Infoblox DNS query capture</span> |
| <span style="color: #808284">view</span> | <span style="color: #808284">Specifies the view</span> | <span style="color: #808284">Example: 1, 2</span> | <span style="color: #808284">Infoblox DNS query capture</span> |

## Infoblox DHCP Performance

|  |  |  |  |
| --- | --- | --- | --- |
| **Extracted Field Name** | **Description of the field** | **Values/Range** | **Source of Data** |
| EA | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-EA)</span> |  |  |
| HWTYPE | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-HWTYPE)</span> |  |  |
| MAX_DB_OBJECTS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DB_OBJECTS)</span> |  |  |
| MAX_DHCP_LPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DHCP_LPS)</span> |  |  |
| MAX_DNS_QPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DNS_QPS)</span> |  |  |
| MEMBER_IP | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MEMBER_IP)</span> |  |  |
| NETWORK | Specifies the network address | Example: 10.0.0.0/8 | Evaluated from **address** and **cidr** field values |
| address | Specifies the DHCP client address | IP address | Infoblox DHCP performance |
| address_total | Specifies the total number of addresses | Integer | Infoblox DHCP performance |
| cidr | Specifies the CIDR | Example: 24 | Infoblox DHCP performance |
| date_hour | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_hour)</span> |  |  |
| date_mday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_mday)</span> |  |  |
| date_minute | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_minute)</span> |  |  |
| date_month | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_month)</span> |  |  |
| date_second | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_second)</span> |  |  |
| date_wday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_wday)</span> |  |  |
| date_year | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_year)</span> |  |  |
| date_zone | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_zone)</span> |  |  |
| dhcp_hosts | Specifies the DHCP hosts count | Integer | Infoblox DHCP performance |
| > Macro (anchor)

dhcp_utilization | Specifies the DHCP utilization | Integer | Infoblox DHCP performance |
| dhcp_utilization_status | Specifies the DHCP utilization status | String | Infoblox DHCP performance |
| > Macro (anchor)<br>dhcpv4ack | Specifies the DHCPv4 ACK message count | Integer | Infoblox DHCP performance |
| > Macro (anchor)

dhcpv4decline | Specifies the DHCPv4 decline message count | Integer | Infoblox DHCP performance |
| > Macro (anchor)

dhcpv4discover | Specifies the DHCPv4 discover message count | Integer | Infoblox DHCP performance |
| > Macro (anchor)

dhcpv4inform | Specifies the DHCPv4 inform message count | Integer | Infoblox DHCP performance |
| > Macro (anchor)

dhcpv4leaseactive | Specifies the DHCPv4 lease active message count | Integer | Infoblox DHCP performance |
| > Macro (anchor)

dhcpv4leasequery | Specifies the DHCPv4 lease query message count | Integer | Infoblox DHCP performance |
| > Macro (anchor)

dhcpv4leaseunassigned | Specifies the DHCPv4 lease unassigned message count | Integer | Infoblox DHCP performance |
| > Macro (anchor)

dhcpv4leaseunknown | Specifies the DHCPv4 lease unknown message count | Integer | Infoblox DHCP performance |
| > Macro (anchor)

dhcpv4nak | Specifies the DHCPv4 NAK message count | Integer | Infoblox DHCP performance |
| > Macro (anchor)

dhcpv4offer | Specifies the DHCPv4 offer message count | Integer | Infoblox DHCP performance |
| > Macro (anchor)

dhcpv4release | Specifies the DHCPv4 release message count | Integer | Infoblox DHCP performance |
| > Macro (anchor)

dhcpv4request | Specifies the DHCPv4 request message count | Integer | Infoblox DHCP performance |
| > Macro (anchor)

dhcpv6advertise | Specifies the DHCPv6 advertise message count | Integer | Infoblox DHCP performance |
| > Macro (anchor)

dhcpv6confirm | Specifies the DHCPv6 confirm message count | Integer | Infoblox DHCP performance |
| > Macro (anchor)

dhcpv6decline | Specifies the DHCPv6 decline message count | Integer | Infoblox DHCP performance |
| > Macro (anchor)

dhcpv6information_request | Specifies the DHCPv6 information request message count | Integer | Infoblox DHCP performance |
| > Macro (anchor)

dhcpv6leasequery | Specifies the DHCPv6 lease query message count | Integer | Infoblox DHCP performance |
| > Macro (anchor)

dhcpv6leasequery_reply | Specifies the DHCPv6 lease query reply message count | Integer | Infoblox DHCP performance |
| > Macro (anchor)

dhcpv6rebind | Specifies the DHCPv6 rebind message count | Integer | Infoblox DHCP performance |
| > Macro (anchor)

dhcpv6reconfigure | Specifies the DHCPv6 reconfigure message count | Integer | Infoblox DHCP performance |
| > Macro (anchor)

dhcpv6relay_forward | Specifies the DHCPv6 relay forward message count | Integer | Infoblox DHCP performance |
| > Macro (anchor)

dhcpv6relay_reply | Specifies the DHCPv6 relay reply message count | Integer | Infoblox DHCP performance |
| > Macro (anchor)

dhcpv6release | Specifies the DHCPv6 release message count | Integer | Infoblox DHCP performance |
| > Macro (anchor)

dhcpv6renew | Specifies the DHCPv6 renew message count | Integer | Infoblox DHCP performance |
| > Macro (anchor)

dhcpv6reply | Specifies the DHCPv6 reply message count | Integer | Infoblox DHCP performance |
| > Macro (anchor)

dhcpv6request | Specifies the DHCPv6 request message count | Integer | Infoblox DHCP performance |
| > Macro (anchor)

dhcpv6solicit | Specifies the DHCPv6 solicit message count | Integer | Infoblox DHCP performance |
| display_name | Specifies the DNS View | String | **DNS view lookup** from **dns_viewkey_displayname.csv** using **View** field value |
| > Macro (anchor)

dynamic_hosts | Specifies the dynamic hosts count | Integer | Infoblox DHCP performance |
| end_address | Specifies the end IP address | IP address | Infoblox DHCP performance |
| eventtype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-eventtype)</span> |  |  |
| host | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-host)</span> |  |  |
| index | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-index)</span> |  |  |
| linecount | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-linecount)</span> |  |  |
| members | Specifies the DHCP member | Example: infoblox.localdomain | Infoblox DHCP performance |
| ms_servers | Specifies the MS servers | IP address | Infoblox DHCP performance |
| protocol | Specifies the DHCP protocol | Example: IPV4 |  |
| punct | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-punct)</span> |  |  |
| ranges | Specifies the DHCP ranges count | Integer | Infoblox DHCP performance |
| source | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-source)</span> |  |  |
| sourcetype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-sourcetype)</span> |  |  |
| splunk_server | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server)</span> |  |  |
| splunk_server_group | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server_group)</span> |  |  |
| start_address | Specifies the start IP address | IP address | Infoblox DHCP performance |
| > Macro (anchor)

static_hosts | Specifies the static hosts count | Integer | Infoblox DHCP performance |
| timeendpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timeendpos)</span> |  |  |
| timestamp | Specifies the timestamp of the event | Example: 2017-02-04 03:45:53 | Infoblox DHCP performance |
| timestartpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timestartpos)</span> |  |  |
| View | Specifies the network view | Example: default | Infoblox DHCP performance |

## Infoblox DHCP FingerPrint, DHCP Lease History

|  |  |  |  |
| --- | --- | --- | --- |
| **Extracted Field Name** | **Description of the field** | **Values/Range** | **Source of Data** |
| ACTION | Specifies the action | String. Example: Issued | Infoblox DHCP lease history |
| CIDR | Specifies the CIDR | Integer | Infoblox DHCP lease history |
| DEVICE_CLASS | Specifies the device class | String. Example: Linux | **fingerprint_device_class_lookup** lookup from   
**/storage/spluk/etc/apps/infoblox/lookups**  
**/fingerprint_device_class_map.csv**  
with **FP** value as input  
**OR**   
**os_number_fingerprint_lookup** lookup from   
**/storage/splunk/etc/apps/infoblox/lookups**  
**/os_number_fingerprint_device_class_map.csv**  
with **OS_NUMBER** value as input |
| EA | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-EA)</span> |  |  |
| END_EPOCH | Specifies the end epoch time | Integer | Infoblox DHCP lease history |
| FP | Specifies the name of the DHCP fingerprint | String. Example: No Match | Infoblox DHCP lease history |
| FP_CIDR | Specifies the fingerprint CIDR | Integer. Example: 8 | Infoblox DHCP lease history |
| FP_NW | Specifies the fingerprint network | Network address. Example: 10.0.0.0 | Infoblox DHCP lease history |
| FP_RANGE | Specifies the fingerprint range | Network range. Example: 10.0.0.1-10.0.0.200 | Infoblox DHCP lease history |
| FP_VIEW | Specifies the fingerprint view | String. Example: default | Infoblox DHCP lease history |
| HWTYPE | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-HWTYPE)</span> |  |  |
| LEASE_IP | Specifies the lease IP address | IP address | Infoblox DHCP lease history |
| MAC_DUID | Specifies the MAC address | MAC address | Infoblox DHCP lease history |
| MAX_DB_OBJECTS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DB_OBJECTS)</span> |  |  |
| MAX_DHCP_LPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DHCP_LPS)</span> |  |  |
| MAX_DNS_QPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DNS_QPS)</span> |  |  |
| MEMBER_IP | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MEMBER_IP)</span> |  |  |
| MS Server | Specifies the MS server | IP Address | Infoblox DHCP lease history |
| NW | Specifies the network | Network address. Example: 10.0.0.0 | Infoblox DHCP lease history |
| OPTION12HOST | Specifies the host name that is sent using DHCP Option 12 | String. Example: Fedora21 | Infoblox DHCP lease history |
| OS_NUMBER | Specifies the OS number | Integer | Infoblox DHCP lease history |
| PROTO | Specifies the protocol | String. Example: dhcpd | Infoblox DHCP lease history |
| SFP | SFP | String. Example: Ubuntu/Debian 5/Knoppix 6 | Infoblox DHCP fingerprint |
| START_EPOCH | Specifies the start epoch time | Integer | Infoblox DHCP lease history |
| VIEW | Specifies the view |  | Infoblox DHCP lease history |
| date_hour | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_hour)</span> |  |  |
| date_mday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_mday)</span> |  |  |
| date_minute | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_minute)</span> |  |  |
| date_month | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_month)</span> |  |  |
| date_second | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_second)</span> |  |  |
| date_wday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_wday)</span> |  |  |
| date_year | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_year)</span> |  |  |
| date_zone | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_zone)</span> |  |  |
| display_name | Specifies the DNS view | String | **DNS view lookup** from **dns_viewkey_displayname.csv** using the **View** field value. |
| eventtype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-eventtype)</span> |  |  |
| host | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-host)</span> |  |  |
| index | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-index)</span> |  |  |
| linecount | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-linecount)</span> |  |  |
| punct | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-punct)</span> |  |  |
| source | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-source)</span> |  |  |
| sourcetype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-sourcetype)</span> |  |  |
| splunk_server | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server)</span> |  |  |
| splunk_server_group | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server_group)</span> |  |  |
| timeendpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timeendpos)</span> |  |  |
| timestartpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timestartpos)</span> |  |  |

## Infoblox DDI Utilization

|  |  |  |  |
| --- | --- | --- | --- |
| **Extracted Field**   
**Name** | **Description of the field** | **Values/Range** | **Source of Data** |
| EA | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-EA)</span> |  |  |
| HWTYPE | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-HWTYPE)</span> |  |  |
| MAX_DB_OBJECTS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DB_OBJECTS)</span> |  |  |
| MAX_DHCP_LPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DHCP_LPS)</span> |  |  |
| MAX_DNS_QPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DNS_QPS)</span> |  |  |
| MEMBER_IP | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MEMBER_IP)</span> |  |  |
| address_alloc | Specifies the address allocation count | Integer | Infoblox DDI utilization |
| address_assignable | Specifies the address assignable count | Integer | Infoblox DDI utilization |
| address_assigned | Specifies the address assigned count | Integer | Infoblox DDI utilization |
| address_conflicts | Specifies the address conflicts count |  | Infoblox DDI utilization |
| address_reserved | Specifies the address reserved count | Integer | Infoblox DDI utilization |
| address_total | Specifies the total number of addresses | Integer | Infoblox DDI utilization |
| address_unalloc | Specifies the address unallocation count | Integer | Infoblox DDI utilization |
| address_unmanaged | Specifies the address unmanaged count | Integer | Infoblox DDI utilization |
| allocation | Allocation | Integer | Infoblox DDI utilization |
| cidr | Specifies the CIDR | Example: 24 | Infoblox DDI utilization |
| date_hour | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_hour)</span> |  |  |
| date_mday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_mday)</span> |  |  |
| date_minute | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_minute)</span> |  |  |
| date_month | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_month)</span> |  |  |
| date_second | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_second)</span> |  |  |
| date_wday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_wday)</span> |  |  |
| date_year | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_year)</span> |  |  |
| date_zone | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_zone)</span> |  |  |
| discovered_name | Specifies the discovered name | String | Infoblox DDI utilization |
| display_name | Specifies the DNS view | String | **DNS view lookup** from **dns_viewkey_displayname.csv** using the **View** field value |
| eventtype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-eventtype)</span> |  |  |
| first_discovered_timestamp | Specifies the first discovered timestamp | Timestamp | Infoblox DDI utilization |
| host | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-host)</span> |  |  |
| hosts | Specifies the address hosts count | Integer | Infoblox DDI utilization |
| index | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-index)</span> |  |  |
| ip_address | Specifies the IP address | IP Address | Infoblox DDI utilization |
| last_discovered_timestamp | Specifies the last discovered timestamp | timestamp | Infoblox DDI utilization |
| linecount | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-linecount)</span> |  |  |
| managed | Indicates if managed or not | Boolean | Infoblox DDI utilization |
| management_platform | Specifies the management platform | String | Infoblox DDI utilization |
| members | Specifies the DHCP members | Example: infoblox.localdomain | Infoblox DDI utilization |
| ms_primary | Specifies the MS primary | String | Infoblox DDI utilization |
| port_vlan_name | Specifies the VLAN port name | String | Infoblox DDI utilization |
| port_vlan_number | Specifies the VLAN port number | Integer | Infoblox DDI utilization |
| network_view | Specifies the network view | String | Infoblox DDI utilization |
| primary | Primary | FQDN | Infoblox DDI utilization |
| protocol | Specifies the DHCP protocol | Example: IPV4 | Infoblox DDI utilization |
| punct | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-punct)</span> |  |  |
| rr_a | Specifies the resource record A count | Integer | Infoblox DDI utilization |
| rr_aaaa | Specifies the resource record AAAA count | Integer | Infoblox DDI utilization |
| rr_cname | Specifies the resource record CNAME count | Integer | Infoblox DDI utilization |
| rr_dhcid | Specifies the resource record DHCID count | Integer | Infoblox DDI utilization |
| rr_dname | Specifies the resource record DNAME count | Integer | Infoblox DDI utilization |
| rr_dnskey | Specifies the resource record DNSKEY count | Integer | Infoblox DDI utilization |
| rr_ds | Specifies the resource record DS count | Integer | Infoblox DDI utilization |
| rr_lbdn | Specifies the resource record LBDN count | Integer | Infoblox DDI utilization |
| rr_mx | Specifies the resource record MX count | Integer | Infoblox DDI utilization |
| rr_naptr | Specifies the resource record NAPTR count | Integer | Infoblox DDI utilization |
| rr_ns | Specifies the resource record NS count | Integer | Infoblox DDI utilization |
| rr_nsec | Specifies the resource record NSEC count | Integer | Infoblox DDI utilization |
| rr_nsec3 | Specifies the resource record NSEC3 count | Integer | Infoblox DDI utilization |
| rr_nsec3param | Specifies the resource record NSEC3PARAM count | Integer | Infoblox DDI utilization |
| rr_other | Specifies the resource record OTHER count | Integer | Infoblox DDI utilization |
| rr_ptr | Specifies the resource record PTR count | Integer | Infoblox DDI utilization |
| rr_rrsig | Specifies the resource record RRSIG count | Integer | Infoblox DDI utilization |
| rr_soa | Specifies the resource record SOA count | Integer | Infoblox DDI utilization |
| rr_srv | Specifies the resource record SRV count | Integer | Infoblox DDI utilization |
| rr_tlsa | Specifies the resource record TLSA count | Integer | Infoblox DDI utilization |
| rr_total | Specifies the resource record TOTAL count | Integer | Infoblox DDI utilization |
| rr_txt | Specifies the resource record TXT count | Integer | Infoblox DDI utilization |
| signed | Indicates whether signed or not | Boolean | Infoblox DDI utilization |
| source | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-source)</span> |  |  |
| sourcetype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-sourcetype)</span> |  |  |
| splunk_server | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server)</span> |  |  |
| splunk_server_group | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server_group)</span> |  |  |
| timeendpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timeendpos)</span> |  |  |
| Timestamp | Specifies the timestamp of the event | Example: 2017-02-04 03:45:53 | Infoblox DDI utilization |
| timestartpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timestartpos)</span> |  |  |
| utilization | Specifies the address utilization count | Integer | Infoblox DDI utilization |
| view | Specifies the network view | Example: default | Infoblox DDI utilization |
| zone_format | Specifies the zone format | String. Example: Forward-Mapping | Infoblox DDI utilization |
| zone_name | Specifies the zone name | String. Example: member1.com | Infoblox DDI utilization |
| zones_forward | Specifies the zone forward count | Integer | Infoblox DDI utilization |
| zones_ipv4 | Specifies the IPv4 count of the zone | Integer | Infoblox DDI utilization |
| zones_ipv6 | Specifies the IPv6 count of the zone | Integer | Infoblox DDI utilization |
| zones_signed | Specifies the signed count of the zone | Integer | Infoblox DDI utilization |

## Infoblox Discovered Devices related dashboards/reports

|  |  |  |  |
| --- | --- | --- | --- |
| **Extracted Field Name** | **Description of the field** | **Values/Range** | **Source of Data** |
| ADM_DN_OP_DN_COUNT | Admin-Down/Operation-DownPort Count | Integer | Infoblox discovered devices related  
dashboards/reports |
| ADM_UP_OP_DN_COUNT | Admin-Up/Operation-UpPort Count | Integer | Infoblox discovered devices related  
dashboards/reports |
| ADM_UP_OP_UP_COUNT | Admin-Up/Operation-DownPort Count | Integer | Infoblox discovered devices related  
dashboards/reports |
| COMPONENT_NAME | Specifies the component name | String. Example: DELL-PC8024F | Infoblox discovered devices related  
dashboards/reports |
| COMPONENT_TYPE | Specifies the component type | String. Example: Switch-Router | Infoblox discovered devices related  
dashboards/reports |
| COMPONENT_PORT | Specifies the component port | String. Example: Gi1/0/24 | Infoblox discovered devices related  
dashboards/reports |
| DEVICE_MGMT_IP | Specifies the device management IP address | IP address | Infoblox discovered devices related  
dashboards/reports |
| DEVICE_MODEL | Specifies the device model | String. Example: EX2200 | Infoblox discovered devices related  
dashboards/reports |
| DEVICE_NAME | Specifies the device name | String. Example: Cisco_434f44 | Infoblox discovered devices related  
dashboards/reports |
| DEVICE_TYPE | Specifies the device type | String. Example: Switch, Router | Infoblox discovered devices related  
dashboards/reports |
| DEVICE_VENDOR | Specifies the device vendor | String. Example: Avaya | Infoblox discovered devices related  
dashboards/reports |
| DISCOVERED_MAC_DUID | Specifies the discovered MAC DUID | MAC address | Infoblox discovered devices related  
dashboards/reports |
| DISCOVERED_NAME | Specifies the discoverd name | Example: dev_view1.yahoo.com | Infoblox discovered devices related  
dashboards/reports |
| EA | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-EA)</span> |  |  |
| HWTYPE | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-HWTYPE)</span> |  |  |
| IN_USE_FLAG | In use flag | Integer. Example: 1 | Infoblox discovered devices related  
dashboards/reports |
| IPADDR | Specifies the IP address | IP Address. Example: 11.11.11.11 | Infoblox discovered devices related  
dashboards/reports |
| IPADDR_MASK | Specifies the IP address mask | Integer. Example: 128 | Infoblox discovered devices related  
dashboards/reports |
| MAC_DUID | Specifies the MAC address | MAC address | Infoblox discovered devices related  
dashboards/reports |
| MAX_DB_OBJECTS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DB_OBJECTS)</span> |  |  |
| MAX_DHCP_LPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DHCP_LPS)</span> |  |  |
| MAX_DNS_QPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DNS_QPS)</span> |  |  |
| MEMBER_IP | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MEMBER_IP)</span> |  |  |
| NETWORK_VIEW | Specifies the network view | String. Example: default | Infoblox discovered devices related  
dashboards/reports |
| NON_NULL_NAME | Specifies the non-null name | String. Example: DELL-PC8024F | Evaluated from the **COMPONENT_NAME** field |
| NON_NULL_PORT | Specifies the non-null port | String. Example: Gi1/0/24 | Evaluated from **COMPONENT_PORT** field |
| TIMESTAMP | Specifies the timestamp | Timestamp. Example: 2017-02-15 15:56:27 | Infoblox discovered devices related  
dashboards/reports |
| TIMESTAMP_USER_HOST_<br>PROCESS_PID_INFO_PREFIX | Specifies the timestamp userhost process pid info prefix | String. Example: 2017-02-15T11:02:53+00:00 user infoblox.localdomain   
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="e5d51f7e-f354-4235-870a-9e02f49b3d41"><ac:plain-text-body><![CDATA[python[]: info ipaddr-activity-rpt | Infoblox discovered devices related  
dashboards/reports |
| TOTAL_AVAIL_COUNT | Specifies the total available count | Integer | Infoblox discovered devices related  
dashboards/reports |
| Type | Specifies the type | String. Example: Discovery | **ipaddr_mask_lookup** lookup from **/storage/splunk/etc/apps/infoblox**  
**/lookups/ipaddr_mask_lookup.csv** with   
**IPADDR_MASK** value as input |
| ap_bss_mac | Access Point BSS MAC | MAC address | Infoblox discovered devices related  
dashboards/reports |
| ap_ip_dotted | Access Point IP dotted | String | Infoblox discovered devices related  
dashboards/reports |
| ap_mac | Access Point MAC | MAC address | Infoblox discovered devices related  
dashboards/reports |
| ap_name | Access Point name | String | Infoblox discovered devices related  
dashboards/reports |
| ap_associated_ssid | Access Point associated SSID | String | Infoblox discovered devices related  
dashboards/reports |
| asset_type | Specifies the asset type | String. Example: Physical Device | Infoblox discovered devices related  
dashboards/reports |
| class | Specifies the class name | String. Example: port | Infoblox discovered devices related  
dashboards/reports |
| component_name | Specifies the component name | String. Example: GigabitEthernet1/0/1 | Infoblox discovered devices related  
dashboards/reports |
| date_hour | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_hour)</span> |  |  |
| date_mday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_mday)</span> |  |  |
| date_minute | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_minute)</span> |  |  |
| date_month | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_month)</span> |  |  |
| date_second | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_second)</span> |  |  |
| date_wday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_wday)</span> |  |  |
| date_year | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_year)</span> |  |  |
| date_zone | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_zone)</span> |  |  |
| Description | Specifies the description | String. Example: Gigabit Ethernet Port | Infoblox discovered devices related  
dashboards/reports |
| device_id | Specifies the device ID | Integer | Infoblox discovered devices related  
dashboards/reports |
| device_ip_address | Specifies the device IP address | IP address | Infoblox discovered devices related  
dashboards/reports |
| device_model | Specifies the device model | String. Example: catalyst37xxStack | Infoblox discovered devices related  
dashboards/reports |
| device_name | Specifies the device name | String. Example:DELL-PC8024F | Infoblox discovered devices related  
dashboards/reports |
| device_os_version | Specifies the device OS version | String. Example: 4.14.6M | Infoblox discovered devices related  
dashboards/reports |
| device_type | Specifies the device type | String. Example: Switch | Infoblox discovered devices related  
dashboards/reports |
| device_vendor | Specifies the device vendor | String. Example: Cisco | Infoblox discovered devices related  
dashboards/reports |
| device_version | Specifies the device version | String. Example: 5.1.2.3 | Infoblox discovered devices related dashboards/reports |
| display_name | Specifies the DNS view | String | Infoblox discovered devices related dashboards/reports |
| end_host_addl_info | Specifies additional information about the end host | String | Infoblox discovered devices related dashboards/reports |
| end_host_device_model | Specifies the device model of the end host | String. Example: catalyst37xxStack | Infoblox discovered devices related dashboards/reports |
| end_host_device_type | Specifies the device type of the end host | String. Example: Switch-Router | Infoblox discovered devices related dashboards/reports |
| end_host_device_vendor | Specifies the device vendor of the end host | String. Example: Cisco | Infoblox discovered devices related dashboards/reports |
| end_host_first_discovered | Specifies the first occasion when the end host was first discovered | Integer | Infoblox discovered devices related dashboards/reports |
| end_host_ip_address | Specifies the IP address of the end host | IP address | Infoblox discovered devices related dashboards/reports |
| end_host_last_discovered | Indicates when was end host last discovered | Integer | Infoblox discovered devices related dashboards/reports |
| end_host_mac_address | Specifies the MAC address of the end host | MAC address | Infoblox discovered devices related dashboards/reports |
| end_host_name | Specifies the name of the end host | String. Example: WS-C3750X-24P | Infoblox discovered devices related dashboards/reports |
| end_host_network_view | Specifies the network view of the end host | String. Example: custom view | Infoblox discovered devices related dashboards/reports |
| end_host_os_version | Specifies the version of the end host OS | String. Example: 15.2(1)E2 | Infoblox discovered devices related dashboards/reports |
| eventtype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-eventtype)</span> |  |  |
| firmware_rev | Indicates firmware revision | String. Example: 15.2(1)E2 | Infoblox discovered devices related dashboards/reports |
| first_seen | First seen timestamp | Integer | Infoblox discovered devices related dashboards/reports |
| hardware_rev | Specifies revision of the hardware | String. Example: V05 | Infoblox discovered devices related dashboards/reports |
| host | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-host)</span> |  |  |
| index | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-index)</span> |  |  |
| interface_admin_status | Specifies the interface admin status | String. Example: up | Infoblox discovered devices related dashboards/reports |
| interface_description | Specifies the interface interface description | String | Infoblox discovered devices related dashboards/reports |
| interface_ip_address | Specifies the interface IP address | IP address | Infoblox discovered devices related dashboards/reports |
| interface_name | Specifies the interface name | String. Example: Fa0 | Infoblox discovered devices related dashboards/reports |
| interface_port_status | Specifies the interface port status | String. Example: up | Infoblox discovered devices related dashboards/reports |
| interface_speed | Specifies the interface speed | Integer. Example: 1000000000 | Infoblox discovered devices related dashboards/reports |
| interface_type | Specifies the interface type | String. Example: tunnel | Infoblox discovered devices related dashboards/reports |
| interface_vlan | Specifies the interface VLAN ID | Integer Example: 16 | Infoblox discovered devices related dashboards/reports |
| interface_vlan_name | Specifies the interface VLAN name | String. Example: VLAN1014 | Infoblox discovered devices related dashboards/reports |
| ip_address | Specifies the IP address | IP address | Infoblox discovered devices related dashboards/reports |
| is_trunk_port | Specifies if it is a trunk port or not | Boolean | Infoblox discovered devices related dashboards/reports |
| last_seen | Specifies the last seen timestamp | Integer | Infoblox discovered devices related dashboards/reports |
| linecount | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-linecount)</span> |  |  |
| model | Specifies the model name | String. Example: DCS-7048T-A | Infoblox discovered devices related dashboards/reports |
| network_view | Specifies the network view | String. Example: custom view | Infoblox discovered devices related dashboards/reports |
| port_last_changed_at | The timestamp when the port was last changed | Timestamp | Infoblox discovered devices related dashboards/reports |
| punct | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-punct)</span> |  |  |
| serial_number | Specifies the serial number | String. Example: JPE12440180 | Infoblox discovered devices related dashboards/reports |
| software_rev | Specifies the software revision | String. Example: 15.2(1)E2 | Infoblox discovered devices related dashboards/reports |
| source | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-source)</span> |  |  |
| sourcetype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-sourcetype)</span> |  |  |
| splunk_server | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server)</span> |  |  |
| splunk_server_group | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server_group)</span> |  |  |
| switch_interface | Specifies the switch interface | String. Example: Gi0/47 | Infoblox discovered devices related dashboards/reports |
| switch_ip_address | Specifies the switch IP Address | IP Address | Infoblox discovered devices related dashboards/reports |
| switch_model | Indicates the switch model | String. Example: cat3560x48 | Infoblox discovered devices related dashboards/reports |
| switch_name | Specifies the switch name | String. Example: ni-mri-sw4.inca.infoblox.com | Infoblox discovered devices related dashboards/reports |
| switch_os_version | Specifies the OS version of the switch | String. Example: 12.2(53)SE2 | Infoblox discovered devices related dashboards/reports |
| switch_type | Specifies the switch type | String. Example: Switch | Infoblox discovered devices related dashboards/reports |
| switch_vendor | Specifies the vendor of the switch | String. Example: Cisco | Infoblox discovered devices related dashboards/reports |
| switch_vlan | Specifies the switch VLAN | Integer. Example: 18 | Infoblox discovered devices related dashboards/reports |
| timeendpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timeendpos)</span> |  |  |
| timestamp | Indicates the timestamp | Integer | Infoblox discovered devices related dashboards/reports |
| timestamp_user_host_process_pid_info_prefix | Specifies the prefix | String | Infoblox discovered devices related dashboards/reports |
| timestartpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timestartpos)</span> |  |  |
| user_id | Specifies the User ID |  | Infoblox discovered devices related dashboards/reports |
| View | Specifies the DNS view | String | Infoblox discovered devices related  
dashboards/reports |
| virtual_ind | Specifies the virtual indicator | Integer |  |

## Infoblox Threat Protection related dashboards/reports

|  |  |  |  |
| --- | --- | --- | --- |
| **Extracted Field Name** | **Description of the field** | **Values/Range** | **Source of Data** |
| ACOUNT | ACOUNT | Integer | Infoblox threat protection   
related dashboards/reports |
| ACTIVE_COUNT | Specifies the active count | Integer | Infoblox threat protection   
related dashboards/reports |
| ALERT_ID | Specifies the alert ID | Integer | Infoblox threat protection   
related dashboards/reports |
| ALERT_TYPE | Specifies the alert type | String | Infoblox threat protection   
related dashboards/reports |
| BLOCK_END | Specifies the block end IP address | Integer | Infoblox threat protection   
related dashboards/reports |
| BLOCK_START | Specifies the block start IP address | Integer | Infoblox threat protection   
related dashboards/reports |
| CATEGORY | Specifies the category | String. Example: OSPF | Infoblox threat protection   
related dashboards/reports |
| CLIENT | Specifies the client | String | Infoblox threat protection   
related dashboards/reports |
| COUNT | Specifies the count | Integer | Infoblox threat protection   
related dashboards/reports |
| DCOUNT | Specifies the DCOUNT | Integer | Infoblox threat protection   
related dashboards/reports |
| DNST_CATEGORY | Specifies the destination category | String | Infoblox threat protection   
related dashboards/reports |
| DOMAIN_NAME | Specifies the domain name | String | Infoblox threat protection   
related dashboards/reports |
| EA | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-EA)</span> |  |  |
| FIREEYE_APPLIANCE | Specifies the FireEye appliance | String | Infoblox threat protection   
related dashboards/reports |
| HWTYPE | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-HWTYPE)</span> |  |  |
| LOG_SEVERITY | Specifies log severity | String | Infoblox threat protection   
related dashboards/reports |
| MAX_DB_OBJECTS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DB_OBJECTS)</span> |  |  |
| MAX_DHCP_LPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DHCP_LPS)</span> |  |  |
| MAX_DNS_QPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DNS_QPS)</span> |  |  |
| MEMBER_IP | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MEMBER_IP)</span> |  |  |
| MESSAGE | Specifies the message | String. Example: DROP OSPF unexpected | Infoblox threat protection   
related dashboards/reports |
| MITIGATION_ACTION | Specifies the mitigation action | String | Infoblox threat protection   
related dashboards/reports |
| NAT_STATUS | Specifies the NAT status | String | Infoblox threat protection   
related dashboards/reports |
| RECORD_DATA | Specifies the record data | String | Infoblox threat protection   
related dashboards/reports |
| RPZ_QNAME | Specifies the RPZ QNAME | String | Infoblox threat protection   
related dashboards/reports |
| RULE_DESCRIPTION | Specifies the rule description | String. Example: This rule drops any unexpected OSPF packets when OSPF is disabled. | **atp_rule_sid_lookup** lookup from   
**/tmp/reporting_atp_conf/atp_rule_sid_lookup.csv**   
with **RULE_SID** value as input |
| RULE_NAME | Specifies the rule name | String. Example: DROP OSPF unexpected | **atp_rule_sid_lookup** lookup from   
**/tmp/reporting_atp_conf/atp_rule_sid_lookup.csv**   
with **RULE_SID** value as input |
| RULE_SID | Specifies the rule SID | Integer | Infoblox threat protection   
related dashboards/reports |
| SEVERITY | Specifies the severity | String. Example: INFORMATIONAL | Infoblox threat protection   
related dashboards/reports |
| SID | Specifies the SID | Integer | Infoblox threat protection   
related dashboards/reports |
| SOURCE_IP | Specifies the source IP | IP address | Infoblox threat protection   
related dashboards/reports |
| SOURCE_PORT | Specifies the source port | Integer | Infoblox threat protection   
related dashboards/reports |
| TIMESTAMP | Indicates the timestamp | Timestamp | Infoblox threat protection   
related dashboards/reports |
| TOTAL_COUNT | Specifies the total count | Integer | Infoblox threat protection   
related dashboards/reports |
| VIEW | Specifies the DNS view | String | Infoblox threat protection   
related dashboards/reports |
| date_hour | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_hour)</span> |  |  |
| date_mday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_mday)</span> |  |  |
| date_minute | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_minute)</span> |  |  |
| date_month | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_month)</span> |  |  |
| date_second | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_second)</span> |  |  |
| date_wday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_wday)</span> |  |  |
| date_year | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_year)</span> |  |  |
| date_zone | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_zone)</span> |  |  |
| eventtype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-eventtype)</span> |  |  |
| host | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-host)</span> |  |  |
| index | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-index)</span> |  |  |
| linecount | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-linecount)</span> |  |  |
| punct | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-punct)</span> |  |  |
| source | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-source)</span> |  |  |
| sourcetype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-sourcetype)</span> |  |  |
| splunk_server | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server)</span> |  |  |
| splunk_server_group | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server_group)</span> |  |  |
| timestartpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timestartpos)</span> |  |  |

## **Infoblox DNS Traffic Control**

Most of the fields in this index are extracted directly from the** syslog_filtered.log** file. Some of them are mentioned in the table below:

|  |  |  |  |
| --- | --- | --- | --- |
| **Extracted Field Name** | **Description of the field** | **Values/Range** | **Source of Data** |
| EA | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-EA)</span> |  |  |
| HWTYPE | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-HWTYPE)</span> |  |  |
| MAX_DB_OBJECTS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DB_OBJECTS)</span> |  |  |
| MAX_DHCP_LPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DHCP_LPS)</span> |  |  |
| MAX_DNS_QPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DNS_QPS)</span> |  |  |
| MEMBER_IP | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MEMBER_IP)</span> |  |  |
| > Macro (anchor)

available | Specifies the available count | Integer | Infoblox DNS traffic control |
| date_hour | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_hour)</span> |  |  |
| date_mday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_mday)</span> |  |  |
| date_minute | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_minute)</span> |  |  |
| date_month | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_month)</span> |  |  |
| date_second | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_second)</span> |  |  |
| date_wday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_wday)</span> |  |  |
| date_year | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_year)</span> |  |  |
| date_zone | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_zone)</span> |  |  |
| eventtype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-eventtype)</span> |  |  |
| host | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-host)</span> |  |  |
| index | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-index)</span> |  |  |
| linecount | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-linecount)</span> |  |  |
| monitor | Specifies the DNS Traffic Control SNMP health monitor | String | Infoblox DNS traffic control |
| pool | Specifies the pool | String | Infoblox DNS traffic control |
| punct | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-punct)</span> |  |  |
| resource | Specifies the resource | String | Infoblox DNS traffic control |
| > Macro (anchor)

response_count | Specifies the response count | Integer | Infoblox DNS traffic control |
| source | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-source)</span> |  |  |
| sourcetype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-sourcetype)</span> |  |  |
| splunk_server | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server)</span> |  |  |
| splunk_server_group | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server_group)</span> |  |  |
| timeendpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timeendpos)</span> |  |  |
| timestamp | Indicates the timestamp of the event | Example: 2017-02-04 03:45:53 |  |
| timestartpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timestartpos)</span> |  |  |
| > Macro (anchor)

unavailable | Specifies the unavailable count | Integer | Infoblox DNS traffic control |

## Infoblox Cloud related dashboards/reports

|  |  |  |  |
| --- | --- | --- | --- |
| **Extracted Field Name** | **Description of the field** | **Values/Range** | **Source of Data** |
| ACTION | Specifies the action | String. Example: Allocated | Evaluated based on the **action** field value |
| EA | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-EA)</span> |  |  |
| HWTYPE | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-HWTYPE)</span> |  |  |
| MAX_DB_OBJECTS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DB_OBJECTS)</span> |  |  |
| MAX_DHCP_LPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DHCP_LPS)</span> |  |  |
| MAX_DNS_QPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DNS_QPS)</span> |  |  |
| MEMBER_IP | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MEMBER_IP)</span> |  |  |
| TENANT_NAME | Specifies the name of the tenant associated with the VM | String | **tenant_name_lookup** lookup from  
**/storage/splunk/etc/apps/infoblox**  
**/lookups/tenant_name_lookup.csv**  
with **tenant_id** value as input |
| action | Specifies the action count | Integer | Infoblox cloud related dashboards/reports |
| address | Specifies the IP address | IP address | Infoblox cloud related dashboards/reports |
| address_type | Specifies the type of address | Integer | Infoblox cloud related dashboards/reports |
| application_type | Specifies the application type |  | Infoblox cloud related dashboards/reports |
| cidr | Specifies the CIDR | Example: 24 | Infoblox cloud related dashboards/reports |
| cnames | Specifies the common name | String | Infoblox cloud related dashboards/reports |
| date_hour | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_hour)</span> |  |  |
| date_mday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_mday)</span> |  |  |
| date_minute | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_minute)</span> |  |  |
| date_month | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_month)</span> |  |  |
| date_second | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_second)</span> |  |  |
| date_wday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_wday)</span> |  |  |
| date_year | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_year)</span> |  |  |
| date_zone | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_zone)</span> |  |  |
| display_name | Specifies the DNS view | String | **DNS view lookup** from   
**dns_viewkey_displayname.csv**   
using the **VIEW** field value |
| elastic_address | Specifies the elastic IP address | IP address | Infoblox cloud related dashboards/reports |
| eventtype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-eventtype)</span> |  |  |
| Fqdn | Specifies the FQDN | String | Infoblox cloud related dashboards/reports |
| host | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-host)</span> |  |  |
| index | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-index)</span> |  |  |
| interface_name | Specifies the interface name | String | Infoblox cloud related dashboards/reports |
| is_primary_ifc | Indicates if primary IFC or not | Example: 0 (not primary) | Infoblox cloud related dashboards/reports |
| linecount | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-linecount)</span> |  |  |
| location | Specifies the location |  | Infoblox cloud related dashboards/reports |
| mac_address | Specifies the MAC address | Example: 00:11:22:33:44:55 | Infoblox cloud related dashboards/reports |
| mgmt_platform | Specifies management platform | Example: vm132ctest | Infoblox cloud related dashboards/reports |
| network | Specifies the network address | Example: 10.0.0.0/8 | Infoblox cloud related dashboards/reports |
| network_view | Specifies the network view | Example: default | Infoblox cloud related dashboards/reports |
| port_id | Specifies the port ID | Integer | Infoblox cloud related dashboards/reports |
| private_address | Specifies the private address | IP address | Infoblox cloud related dashboards/reports |
| private_hostname | Specifies the private hostname | String | Infoblox cloud related dashboards/reports |
| public_address | Specifies the public address | IP address | Infoblox cloud related dashboards/reports |
| public_hostname | Specifies the public hostname | String | Infoblox cloud related dashboards/reports |
| punct | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-punct)</span> |  |  |
| source | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-source)</span> |  |  |
| sourcetype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-sourcetype)</span> |  |  |
| splunk_server | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server)</span> |  |  |
| splunk_server_group | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server_group)</span> |  |  |
| tenant_id | Specifies the tenant ID | Integer | Infoblox cloud related dashboards/reports |
| timeendpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timeendpos)</span> |  |  |
| timestamp | Indicates the timestamp of the event | Example: 2017-02-04 03:45:53 | Infoblox cloud related dashboards/reports |
| timestartpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timestartpos)</span> |  |  |
| view | Specifies the DNS view | String |  |
| vlan_id | Specifies the VLAN ID | Integer | Infoblox cloud related dashboards/reports |
| vm_hostname | Specifies the hostname of the VM | String | Infoblox cloud related dashboards/reports |
| vm_name | Specifies the name of the VM | Example: 99 | Infoblox cloud related dashboards/reports |
| vm_vpc_address | Specifies the VPC address of the VM | IP address | Infoblox cloud related dashboards/reports |
| vm_vpc_cidr | Specifies the VPC CIDR of the VM | Example: 24 | Infoblox cloud related dashboards/reports |
| vm_vpc_id | Specifies the VPC ID of the VM | Integer | Infoblox cloud related dashboards/reports |
| vm_vpc_name | Specifies the VPC name of the VM | Integer | Infoblox cloud related dashboards/reports |
| vpc_addr | Specifies the VPC address | IP address | Infoblox cloud related dashboards/reports |

## Infoblox Syslog

Most of the fields in this index are extracted directly from the **syslog_filtered.log** file. Some of them are mentioned in the table below:

|  |  |  |  |
| --- | --- | --- | --- |
| **Extracted Field Name** | **Description of the field** | **Values/Range** | **Source of Data** |
| BOOT_IMAGE |  | Example: /boot/bzImage | Infoblox syslog file |
| CPUs |  | Integer. Example: 8 | Infoblox syslog file |
| EA | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-EA)</span> |  |  |
| HWTYPE | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-HWTYPE)</span> |  |  |
| MAX_DB_OBJECTS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DB_OBJECTS)</span> |  |  |
| MAX_DHCP_LPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DHCP_LPS)</span> |  |  |
| MAX_DNS_QPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DNS_QPS)</span> |  |  |
| MEMBER_IP | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MEMBER_IP)</span> |  |  |
| date_hour | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_hour)</span> |  |  |
| date_mday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_mday)</span> |  |  |
| date_minute | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_minute)</span> |  |  |
| date_month | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_month)</span> |  |  |
| date_second | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_second)</span> |  |  |
| date_wday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_wday)</span> |  |  |
| date_year | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_year)</span> |  |  |
| date_zone | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_zone)</span> |  |  |
| eventtype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-eventtype)</span> |  |  |
| group |  | Example: admin-group | Infoblox syslog file |
| hits |  | Integer | Infoblox syslog file |
| host | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-host)</span> |  |  |
| index | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-index)</span> |  |  |
| linecount | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-linecount)</span> |  |  |
| misses |  | Integer | Infoblox syslog file |
| punct | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-punct)</span> |  |  |
| size |  | Integer | Infoblox syslog file |
| source | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-source)</span> |  |  |
| sourcetype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-sourcetype)</span> |  |  |
| splunk_server | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server)</span> |  |  |
| splunk_server_group | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server_group)</span> |  |  |
| timeendpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timeendpos)</span> |  |  |
| timestartpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timestartpos)</span> |  |  |

## System Capacity

|  |  |  |  |
| --- | --- | --- | --- |
| **Extracted Field Name** | **Description of the field** | **Values/Range** | **Source of Data** |
| COUNT | Specifies the count | Integer | System capacity |
| EA | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-EA)</span> |  |  |
| HWTYPE | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-HWTYPE)</span> |  |  |
| MAX_DB_OBJECTS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DB_OBJECTS)</span> |  |  |
| MAX_DHCP_LPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DHCP_LPS)</span> |  |  |
| MAX_DNS_QPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DNS_QPS)</span> |  |  |
| MEMBER_IP | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MEMBER_IP)</span> |  |  |
| PERCENT | Specifies the percentage | Integer | System capacity |
| date_hour | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_hour)</span> |  |  |
| date_mday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_mday)</span> |  |  |
| date_minute | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_minute)</span> |  |  |
| date_month | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_month)</span> |  |  |
| date_second | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_second)</span> |  |  |
| date_wday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_wday)</span> |  |  |
| date_year | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_year)</span> |  |  |
| date_zone | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_zone)</span> |  |  |
| eventtype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-eventtype)</span> |  |  |
| host | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-host)</span> |  |  |
| index | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-index)</span> |  |  |
| linecount | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-linecount)</span> |  |  |
| punct | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-punct)</span> |  |  |
| source | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-source)</span> |  |  |
| sourcetype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-sourcetype)</span> |  |  |
| splunk_server | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server)</span> |  |  |
| splunk_server_group | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server_group)</span> |  |  |
| timeendpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timeendpos)</span> |  |  |
| timestartpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timestartpos)</span> |  |  |

## Infoblox System Utilization (CPU, Memory, Network Traffic) related dashboards/reports

|  |  |  |  |
| --- | --- | --- | --- |
| **Extracted Field Name** | **Description of the field** | **Values/Range** | **Source of Data** |
| > Macro (anchor)

CPU_PERCENT | Specifies the CPU percentage | Integer value within 0-100 | Infoblox system utilization   
related dashboards/reports |
| EA | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-EA)</span> |  |  |
| HWTYPE | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-HWTYPE)</span> |  |  |
| MAX_DB_OBJECTS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DB_OBJECTS)</span> |  |  |
| MAX_DHCP_LPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DHCP_LPS)</span> |  |  |
| MAX_DNS_QPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DNS_QPS)</span> |  |  |
| MEMBER_IP | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MEMBER_IP)</span> |  |  |
| > Macro (anchor)

MEMORY_PERCENT | Specifies the memory percentage | Integer. Value within 0-100 | Infoblox system utilization   
related dashboards/reports |
| > Macro (anchor)

TRAF_VALUE | Specifies the traffic value | Integer | Infoblox system utilization   
related dashboards/reports |
| date_hour | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_hour)</span> |  |  |
| date_mday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_mday)</span> |  |  |
| date_minute | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_minute)</span> |  |  |
| date_month | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_month)</span> |  |  |
| date_second | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_second)</span> |  |  |
| date_wday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_wday)</span> |  |  |
| date_year | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_year)</span> |  |  |
| date_zone | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_zone)</span> |  |  |
| eventtype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-eventtype)</span> |  |  |
| host | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-host)</span> |  |  |
| index | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-index)</span> |  |  |
| linecount | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-linecount)</span> |  |  |
| punct | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-punct)</span> |  |  |
| source | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-source)</span> |  |  |
| sourcetype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-sourcetype)</span> |  |  |
| splunk_server | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server)</span> |  |  |
| splunk_server_group | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server_group)</span> |  |  |
| sys_report_id | Specifies the report ID based on whether inbound or outbound | Integer | Infoblox system utilization   
related dashboards/reports |
| timeendpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timeendpos)</span> |  |  |
| timestartpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timestartpos)</span> |  |  |

## Infoblox Ecosystem Subscription

|  |  |  |  |
| --- | --- | --- | --- |
| **Extracted Field Name** | **Description of the field** | **Values/Range** | **Source of Data** |
| EA | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-EA)</span> |  |  |
| HWTYPE | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-HWTYPE)</span> |  |  |
| MAX_DB_OBJECTS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DB_OBJECTS)</span> |  |  |
| MAX_DHCP_LPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DHCP_LPS)</span> |  |  |
| MAX_DNS_QPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DNS_QPS)</span> |  |  |
| MEMBER_IP | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MEMBER_IP)</span> |  |  |
| cisco_ise_endpoint_profile | Specifies the Cisco ISE endpoint profile | String | Infoblox ecosystem subscription |
| cisco_ise_security_group | Specifies the Cisco ISE security group |  | Infoblox ecosystem subscription |
| cisco_ise_session_state | Specifies the Cisco ISE session state | String. Example: STARTED | Infoblox ecosystem subscription |
| cisco_ise_ssid | Specifies the Cisco ISE SSID | String | Infoblox ecosystem subscription |
| date_hour | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_hour)</span> |  |  |
| date_mday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_mday)</span> |  |  |
| date_minute | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_minute)</span> |  |  |
| date_month | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_month)</span> |  |  |
| date_second | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_second)</span> |  |  |
| date_wday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_wday)</span> |  |  |
| date_year | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_year)</span> |  |  |
| date_zone | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_zone)</span> |  |  |
| domainname | Specifies the domain name | String | Infoblox ecosystem subscription |
| ea_eps_status | Specifies the EPS status of the extensible attribute | String | Infoblox ecosystem subscription |
| eventtype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-eventtype)</span> |  |  |
| guid | Specifies the GUID | String | Infoblox ecosystem subscription |
| host | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-host)</span> |  |  |
| index | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-index)</span> |  |  |
| ip_address | Specifies the IP address | IP address | Infoblox ecosystem subscription |
| last_discovered_timestamp | Specifies the last discovered timestamp | Integer | Infoblox ecosystem subscription |
| linecount | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-linecount)</span> |  |  |
| port_vlan_name | Specifies the VLAN name of the port | String | Infoblox ecosystem subscription |
| port_vlan_number | Specifies the VLAN number of the port | Integer | Infoblox ecosystem subscription |
| punct | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-punct)</span> |  |  |
| source | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-source)</span> |  |  |
| sourcetype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-sourcetype)</span> |  |  |
| splunk_server | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server)</span> |  |  |
| splunk_server_group | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server_group)</span> |  |  |
| timeendpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timeendpos)</span> |  |  |
| timestamp | Specifies the timestamp of the event | Example: 2017-02-04 03:45:53 | Infoblox ecosystem subscription |
| timestartpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timestartpos)</span> |  |  |
| username | Specifies the username | String | Infoblox ecosystem subscription |

## Infoblox Ecosystem Publication

|  |  |  |  |
| --- | --- | --- | --- |
| **Extracted Field Name** | **Description of the field** | **Values/Range** | **Source of Data** |
| EA | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-EA)</span> |  |  |
| HWTYPE | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-HWTYPE)</span> |  |  |
| MAX_DB_OBJECTS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DB_OBJECTS)</span> |  |  |
| MAX_DHCP_LPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DHCP_LPS)</span> |  |  |
| MAX_DNS_QPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DNS_QPS)</span> |  |  |
| MEMBER_IP | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MEMBER_IP)</span> |  |  |
| contents | Specifies the content | String. Example: {'LEASE_STATE': 'STARTED', 'Lease_Start_Time': '2017-03-01T07:00:00Z', 'MAC_OR_DUID': '80:3c:3e:29:84:cc', 'Fingerprint': 'No Match', 'Lease_End_Time': '2017-03-01T07:02:00Z', 'IPAddress': '10.0.0.20', 'Infoblox_Member': '10.35.205.6'} | Infoblox ecosystem publication |
| date_hour | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_hour)</span> |  |  |
| date_mday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_mday)</span> |  |  |
| date_minute | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_minute)</span> |  |  |
| date_month | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_month)</span> |  |  |
| date_second | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_second)</span> |  |  |
| date_wday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_wday)</span> |  |  |
| date_year | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_year)</span> |  |  |
| date_zone | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_zone)</span> |  |  |
| eventtype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-eventtype)</span> |  |  |
| host | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-host)</span> |  |  |
| index | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-index)</span> |  |  |
| ip_address | Specifies the IP address | IP address | Infoblox ecosystem publication |
| linecount | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-linecount)</span> |  |  |
| notification_action | Specifies the notification action | Example: CISCOISE_PUBLISH_IPAM | Infoblox ecosystem publication |
| notification_target | Specifies the notification target | IP address | Infoblox ecosystem publication |
| punct | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-punct)</span> |  |  |
| source | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-source)</span> |  |  |
| sourcetype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-sourcetype)</span> |  |  |
| splunk_server | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server)</span> |  |  |
| splunk_server_group | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server_group)</span> |  |  |
| timeendpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timeendpos)</span> |  |  |
| timestamp | Specifies the timestamp of the event | Example: 2017-02-04 03:45:53 | Infoblox ecosystem publication |
| timestartpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timestartpos)</span> |  |  |

## Reporting License Usage

|  |  |  |  |
| --- | --- | --- | --- |
| **Extracted Field Name** | **Description of the field** | **Values/Range** | **Source of Data** |
| EA | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-EA)</span> |  |  |
| HWTYPE | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-HWTYPE)</span> |  |  |
| MAX_DB_OBJECTS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DB_OBJECTS)</span> |  |  |
| MAX_DHCP_LPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DHCP_LPS)</span> |  |  |
| MAX_DNS_QPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DNS_QPS)</span> |  |  |
| MEMBER_IP | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MEMBER_IP)</span> |  |  |
| date_hour | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_hour)</span> |  |  |
| date_mday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_mday)</span> |  |  |
| date_minute | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_minute)</span> |  |  |
| date_month | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_month)</span> |  |  |
| date_second | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_second)</span> |  |  |
| date_wday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_wday)</span> |  |  |
| date_year | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_year)</span> |  |  |
| date_zone | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_zone)</span> |  |  |
| display_name | Specifies the DNS view | String | **DNS view lookup** from **dns_viewkey_displayname.csv** using the **View** field value |
| eventtype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-eventtype)</span> |  |  |
| host | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-host)</span> |  |  |
| index | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-index)</span> |  |  |
| license_count | Specifies the license count | Integer | Reporting license usage |
| license_pool | Specifies the license pool | String. Example: cloud_api.0 | Reporting license usage |
| linecount | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-linecount)</span> |  |  |
| punct | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-punct)</span> |  |  |
| source | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-source)</span> |  |  |
| sourcetype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-sourcetype)</span> |  |  |
| splunk_server | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server)</span> |  |  |
| splunk_server_group | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server_group)</span> |  |  |
| timeendpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timeendpos)</span> |  |  |
| timestamp | Indicates the timestamp | Timestamp | Reporting license usage |
| timestartpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timestartpos)</span> |  |  |
| utilization | Specifies the utilization | Integer | Reporting license usage |
| view | Specifies the DNS view | String |  |

# Summary Indexes

## Summary Indexes Frequency

The field frequencies of all fields for each summary index are as mentioned below:

|  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- |
| **Summary Index** | **Report** | **Frequency** | **Cron Schedule** | **Earliest**   
**Time** | **Latest**   
**Time** |
| ib_dns_summary | si_dns_reclaimed_object_count_trend | At every 30<sup>th</sup> minute from 21 through 59 | 21-59/30 * * * * | 30m@m | 60m@m |
|  | si_dns_top_clients | At every 30<sup>th</sup> minute from 2 through 59 | 2-59/30 * * * * | 30m@m | 60m@m |
|  | si_dns_query_reply | At every 30<sup>th</sup> minute from 18 through 59 | 18-59/30 * * * * | 30m@m | 60m@m |
|  | si_top_servfail_received_queries | At every 30<sup>th</sup> minute from 7 through 59 | 7-59/30 * * * * | 30m@m | 60m@m |
|  | si_dns_response_latency_trend | At every 30<sup>th</sup> minute from 20 through 59 | 20-59/30 * * * * | 30m@m | 60m@m |
|  | si_dns_member_qps_trend_per_hour | At minute 34 | 34 * * * * | @h | -1h@h |
|  | si_top_nxdomain_query | At every 30<sup>th</sup> minute from 5 through 59 | 5-59/30 * * * * | 30m@m | 60m@m |
|  | si_dns_member_qps_trend_per_day | Every day 32 minutes past midnight | 32 0 * * * | @d | -1d@d |
|  | si_dns_member_qps_trend | At every 30<sup>th</sup> minute from 12 through 59 | 12-59/30 * * * * | 30m@m | 60m@m |
|  | si_dns_requested_domain | At every 30<sup>th</sup> minute from 4 through 59 | 4-59/30 * * * * | 30m@m | 60m@m |
|  | si_dns_qps_trend | At every 30<sup>th</sup> minute from 10 through 59 | 10-59/30 * * * * | 30m@m | 60m@m |
|  | si_top_servfail_sent_queries | At every 30<sup>th</sup> minute from 6 through 59 | 6-59/30 * * * * | 30m@m | 60m@m |
|  | si_ddns_update | At every 30<sup>th</sup> minute from 6 through 59 | 6-59/30 * * * * | 30m@m | 60m@m |
|  | si_dns_cache_hit_ratio | At every 30<sup>th</sup> minute from 8 through 59 | 8-59/30 * * * * | 30m@m | 60m@m |
|  | si_top_timeout_queries | At every 30<sup>th</sup> minute from 8 through 59 | 8-59/30 * * * * | 30m@m | 60m@m |
|  | si_dns_rpz_hits | At every 10<sup>th</sup> minute from 2 through 59 | 2-59/10 * * * * | 10m@m | 20m@m |
|  | si_top_clients_per_domain | At every 30<sup>th</sup> minute from 3 through 59 | 3-59/30 * * * * | 30m@m | 60m@m |
| ib_dhcp_summary | si_dhcp_message | At every 30<sup>th</sup> minute from 14 through 59 | 14-59/30 * * * * | 30m@m | 60m@m |
|  | si_dhcp_usage_trend | At 22 minutes past every 8<sup>th</sup> hour | 22 */8 * * * | 15m@m | 495m@m |
|  | si_dhcp_top_lease_client | At every 30<sup>th</sup> minute from 16 through 59 | 16-59/30 * * * * | 30m@m | 60m@m |
|  | si_devices_denied_an_ip_address | At every 30<sup>th</sup> minute from 19 through 59 | 19-59/30 * * * * | 30m@m | 60m@m |
|  | si_dhcp_range_utilization_trend | At 24 minutes past every 8<sup>th</sup> hour | 24 */8 * * * | 15m@m | 495m@m |
|  | si_dhcp_top_os_by_network | At every 30<sup>th</sup> minute from 16 through 59 | 16-59/30 * * * * | 30m@m | 60m@m |
| ib_dtc_summary | si_dtc_response_distribution | At 37 minutes past every 6<sup>th</sup> hour | 37 */6 * * * | 10m@m | 370m@m |
|  | si_adns_resource_pool_availability | At 23 minutes past every 6<sup>th</sup> hour | 23 */6 * * * | 10m@m | 370m@m |
|  | si_smart_dns_resource_snmp | At 47 minutes past every 6<sup>th</sup> hour | 47 */6 * * * | 10m@m | 370m@m |
|  | si_smart_dns_resource_availability | At 47 minutes past every 6<sup>th</sup> hour | 47 */6 * * * | 10m@m | 370m@m |
| ib_system_summary | si_index_disk_usage | At 37 minutes past every 6<sup>th</sup> hour | 37 */6 * * * | 10m@m | 370m@m |
|  | si_memory_utilization | At every 30<sup>th</sup> minute from 26 through 59 | 26-59/30 * * * * | 30m@m | 60m@m |
|  | si_traffic_rate | At every 30<sup>th</sup> minute from 28 through 59 | 28-59/30 * * * * | 30m@m | 60m@m |
|  | si_cpu_usage | At every 30<sup>th</sup> minute | */30 * * * * | 30m@m | 60m@m |
| ib_security_summary | si_dns_tunneling_activity | At every 3030<sup>th</sup> th minute from 11 through 59 | 11-59/30 * * * * | 30m@m | 60m@m |

**Note**:

- **cron schedule** - cron time scheduled to execute a search
- **earliest time** - specifies the earliest time for a search
- **latest time** - specifies the latest time for a saved search

## Common fields in summary indexes

Splunk server adds the following fields to every event in each summary index.

|  |  |  |  |
| --- | --- | --- | --- |
| **Field Name** | **Description of the field** | **Values/Range** | **Remarks** |
| > Macro (anchor)

info_max_time | The **info_*** fields are added to each event when you use the **addinfo** command. This command is primarily an internally-used component of Summary Indexing. Click <span style="color: #0000ff">[here](https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Addinfo)</span><span style="color: #0000ff"> </span>for more information.   
The latest time boundary for the search. | Integer | Splunk added special field |
| > Macro (anchor)

info_min_time | Specifies the earliest time boundary for search | Integer | Splunk added special field |
| > Macro (anchor)

info_search_time | Specifies the time when search was initiated | Integer | Splunk added special field |
| > Macro (anchor)

search_name | Specifies the name of the saved search | Example: si-search-dns-query-reply | Splunk added special field |
| > Macro (anchor)

search_now | Specifies the time when search was scheduled to run | Integer | Splunk added special field |

## Infoblox DNS Summary

Note: *psrsvd* stands for *prestats reserved{*}. Syntax is psrsvd_\[type\]_\[fieldname\]. These special fields are added by Splunk to summary index data that begins with *psrsvd* when you initiate search using the *si** command to populate a summary index. See <span style="color: #0000ff">[List of available psrsvd types](http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usesummaryindexing)</span> from Splunk docs.

|  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- |
| **Extracted Field Name** | **Description of the field** | **Reports** | **Values/Range** | **Source of Data** | **Remarks** |
| CLIENT | Specifies the IP address of the DNS client |  | Example: 10.39.18.60 |  |  |
| COUNT | Specifies the count of DNS queries | si_dns_top_clients | Integer |  |  |
|  | Specifies the count of SERVFAIL errors that are received for DNS clients | si_top_servfail_received_queries | Integer |  |  |
|  | Specifies the count of NXDOMAIN/NOERROR replies for DNS clients | si_top_nxdomain_query | Integer |  |  |
|  | Specifies the count of DNS domain name requests | si_dns_requested_domain | Integer |  |  |
|  | Specifies the count of DNS queries per second | si_dns_qps_trend | Integer |  |  |
|  | Specifies the count of DNS SERVFAIL errors that are sent for DNS queries | si_top_servfail_sent_queries | Integer |  |  |
|  | Specifies the count of DNS timed-out recursive queries | si_top_timeout_queries | Integer |  |  |
|  | Specifies the average count of DNS RPX hits | si_dns_rpz_hits | Integer |  |  |
|  | Specifies the count of DNS clients per domain | si_top_clients_per_domain | Integer |  |  |
| EA | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-EA)</span> |  |  |  |  |
| FQDN | Specifies the fully qualified domain name | si_dns_requested_domain and   
si_top_clients_per_domain | Example: 213.31.102.10.in-addr.arpa |  |  |
| HWTYPE | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-HWTYPE)</span> |  |  |  |  |
| MAX_DB_OBJECTS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DB_OBJECTS)</span> |  |  |  |  |
| MAX_DHCP_LPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DHCP_LPS)</span> |  |  |  |  |
| MAX_DNS_QPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DNS_QPS)</span> |  |  |  |  |
| MEMBER | Specifies the member |  | String | Infoblox DNS Summary |  |
| MEMBER_IP | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MEMBER_IP)</span> |  |  |  |  |
| TLD | Specifies top level domain names | si_dns_requested_domain | Example: arpa |  |  |
| TYPE | Specifies the DNS response type | si_dns_query_reply,   
si_dns_qps_trend, and   
si_ddns_update | SUCCESS/NOERROR **OR**  
REFERRAL **OR**  
NXRRSET **OR**  
NXDOMAIN **OR**  
REFUSED **OR**  
OTHER |  |  |
| VIEW | It refers to the DNS view key to map DNS view through lookup. See <span style="color: #0000ff">[display_name](#Chapter41ReportingDataModel-display_name)</span> field. | si_dns_requested_domain,   
si_dns_top_clients,   
si_dns_member_qps_trend_per_hour, si_dns_member_qps_trend_per_day,   
si_dns_member_qps_trend,   
si_dns_qps_trend,   
si_ddns_update,   
si_dns_cache_hit_ratio,   
si_dns_rpz_hits,   
si_top_clients_per_domain,   
si_top_timeout_queries,   
si_top_servfail_sent_queries,   
si_top_nxdomain_query, and   
si_top_servfail_received_queries | Example: _default |  |  |
| date_hour | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_hour)</span> |  |  |  |  |
| date_mday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_mday)</span> |  |  |  |  |
| date_minute | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_minute)</span> |  |  |  |  |
| date_month | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_month)</span> |  |  |  |  |
| date_second | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_second)</span> |  |  |  |  |
| date_wday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_wday)</span> |  |  |  |  |
| date_year | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_year)</span> |  |  |  |  |
| date_zone | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_zone)</span> |  |  |  |  |
| display_name | Specifies the DNS view | si_dns_requested_domain,   
si_dns_top_clients,   
si_dns_member_qps_trend_per_hour,  
si_dns_member_qps_trend_per_day,   
si_dns_member_qps_trend,   
si_dns_qps_trend,   
si_ddns_update,   
si_dns_cache_hit_ratio,   
si_dns_rpz_hits,   
si_top_clients_per_domain,   
si_top_timeout_queries,   
si_top_servfail_sent_queries,   
si_top_nxdomain_query, and   
si_top_servfail_received_queries | <span style="color: #3e3f40">Example: default.MS-2016</span> |  | Lookup from **dns_viewkey_displayname.csv**  
using the **VIEW** field value |
| eventtype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-eventtype)</span> |  |  |  |  |
| host | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-host)</span> |  |  |  |  |
| index | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-index)</span> |  |  |  |  |
| info_max_time | <span style="color: #0000ff">[Common summary index fields](#Chapter41ReportingDataModel-info_max_time)</span> |  |  |  |  |
| info_min_time | <span style="color: #0000ff">[Common summary index fields](#Chapter41ReportingDataModel-info_min_time)</span> |  |  |  |  |
| info_search_time | <span style="color: #0000ff">[Common summary index fields](#Chapter41ReportingDataModel-info_search_time)</span> |  |  |  |  |
| linecount | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-linecount)</span> |  |  |  |  |
| orig_host | Specifies the host name of the data source |  | Example: infoblox.com |  | Splunk added default field |
| psrsvd_ct_COUNT | Here, ct = count. It contains the count information for the COUNT field. | si_dns_query_reply and si_dns_qps_trend |  |  | Splunk added special field |
| psrsvd_ct_LATENCY | Contains the count information for the LATENCY field | si_dns_response_latency_trend |  |  | Splunk added special field |
| psrsvd_ct_QCOUNT | Contains the count information for the QCOUNT field | si_dns_member_qps_trend_per_hour,  
si_dns_member_qps_trend_per_day,   
and si_dns_member_qps_trend |  |  | Splunk added special field |
| psrsvd_gc | Here, gc = group count. It indicates the count for stats grouping and it is not scoped to a single field. | si_dns_query_reply,  
si_dns_response_latency_trend,  
si_dns_member_qps_trend_per_hour,  
si_dns_member_qps_trend_per_day,  
si_dns_member_qps_trend, and   
si_dns_qps_trend |  |  | Splunk added special field |
| psrsvd_nc_COUNT | Here, nc = numerical count. It indicates the number of numerical values and contains the numerical count information for the COUNT field. | si_dns_query_reply and   
si_dns_qps_trend |  |  | Splunk added special field |
| psrsvd_nc_LATENCY | Contains the numerical count information for the LATENCY field | si_dns_response_latency_trend |  |  | Splunk added special field |
| psrsvd_nc_QCOUNT | Contains the numerical count information for the QCOUNT field | si_dns_member_qps_trend_per_hour,  
si_dns_member_qps_trend_per_day,   
and si_dns_member_qps_trend |  |  | Splunk added special field |
| psrsvd_nx_QCOUNT | Here, nx = maximum numerical value. It contains the maximum numerical value information for the QCOUNT field. | si_dns_member_qps_trend_per_hour and   
si_dns_member_qps_trend_per_day |  |  | Splunk added special field |
| psrsvd_sm_COUNT | Here, sm = sum. It contains the sum information for the COUNT field. | si_dns_query_reply and   
si_dns_qps_trend |  |  | Splunk added special field |
| psrsvd_sm_LATENCY | Contains the sum information for the LATENCY field. | si_dns_response_latency_trend |  |  | Splunk added special field |
| psrsvd_sm_QCOUNT | Contains the sum information for the QCOUNT field | si_dns_member_qps_trend_per_hour,  
si_dns_member_qps_trend_per_day,   
and si_dns_member_qps_trend |  |  | Splunk added special field |
| psrsvd_sx_QCOUNT | Here, sx = maximum lexicographical value.   
It contains the maximum lexicographical value information for the QCOUNT field | si_dns_member_qps_trend_per_hour  
and si_dns_member_qps_trend_per_day |  |  | Splunk added special field |
| psrsvd_v | Here, v = version. This is not scoped to a single field. | si_dns_query_reply,  
si_dns_response_latency_trend,  
si_dns_member_qps_trend_per_hour,  
si_dns_member_qps_trend_per_day,  
si_dns_member_qps_trend, and  
si_dns_qps_trend |  |  | Splunk added special field |
| psrsvd_vt_COUNT | Here, vt = value type. It contains precision of the associated field.   
This field contains precision of the COUNT field. | si_dns_query_reply and   
si_dns_qps_trend |  |  | Splunk added special field |
| psrsvd_vt_LATENCY | Contains precision of the LATENCY field | si_dns_response_latency_trend |  |  | Splunk added special field |
| psrsvd_vt_QCOUNT | Contains precision of the QCOUNT field | si_dns_member_qps_trend_per_hour,  
si_dns_member_qps_trend_per_day,   
and si_dns_member_qps_trend |  |  | Splunk added special field |
| **report** | **Contains the name of the report that populates the summary index** |  |  |  |  |
|  | **DNS Scavenge Object Count Trend data** | si_dns_reclaimed_object_count_trend |  |  |  |
|  | **DNS Top Clients report data** | si_dns_top_clients |  |  |  |
|  | **DNS Replies Trend data** | si_dns_query_reply |  |  |  |
|  | **DNS Top SERVFAIL Errors Received Report data** | si_top_servfail_received_queries |  |  |  |
|  | **DNS Response Latency Trend data** | si_dns_response_latency_trend |  |  |  |
|  | **DNS Daily Peak Hour Query Rate by Member Report data** | si_dns_member_qps_trend_per_hour |  |  |  |
|  | **DNS Top NXDOMAIN / NOERROR (no data) Report data** | si_top_nxdomain_query |  |  |  |
|  | **DNS Daily Query Rate by Member Report data** | si_dns_member_qps_trend_per_day |  |  |  |
|  | **DNS Query Rate by Member Report data** | si_dns_member_qps_trend |  |  |  |
|  | **DNS Top Requested Domain Names Report data** | si_dns_requested_domain |  |  |  |
|  | **DNS Queries Per Second Trend data** | si_dns_qps_trend |  |  |  |
|  | **DNS Top SERVFAIL Errors Sent Report data** | si_top_servfail_sent_queries |  |  |  |
|  | **DDNS Update Rate Trend data** | si_ddns_update |  |  |  |
|  | **DNS Cache Hit Rate Trend data** | si_dns_cache_hit_ratio |  |  |  |
|  | **DNS Top Timed-Out Recursive Queries Report data** | si_top_timeout_queries |  |  |  |
|  | **DNS RPZ Hits Reports data** | si_dns_rpz_hits |  |  |  |
|  | **DNS Top Clients per Domain Report data** | si_top_clients_per_domain |  |  |  |
| search_name | <span style="color: #0000ff">[Common summary index fields ](#Chapter41ReportingDataModel-search_name)</span> |  |  |  |  |
| search_now | <span style="color: #0000ff">[Common summary index fields](#Chapter41ReportingDataModel-search_now)</span> |  |  |  |  |
| source | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-source)</span> |  |  |  |  |
| sourcetype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-sourcetype)</span> |  |  |  |  |
| splunk_server | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server)</span> |  |  |  |  |
| splunk_server_group | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server_group)</span> |  |  |  |  |
| timeendpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timeendpos)</span> |  |  |  |  |
| timestartpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timestartpos)</span> |  |  |  |  |

## Infoblox DHCP Summary

|  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- |
| **Extracted Field Name** | **Description of the field** | **Reports** | **Values/Range** | **Source of Data** | **Remarks** |
| ACTION | Specifies the action |  | String. Example: Issued | Infoblox DHCP summary |  |
| DEVICE_CLASS | Specifies the device class |  | String. Example: Linux | **fingerprint_device_class_lookup**   
lookup from **/storage/splunk/etc**  
**/apps/infoblox/lookups/fingerprint**  
**_device_class_map.csv** with **FP** value   
as input   
**OR**   
**os_number_fingerprint_lookup** lookup   
from **/storage/splunk/etc/apps/infoblox**  
**/lookups/os_number_fingerprint_device_**  
**class_map.csv** with **OS_NUMBER** value   
as input |  |
| DHCP_RANGE | Specifies the DHCP range |  | Network range. Example: 10.0.0.1-10.0.0.200 | Evaluated from the **start_address**   
and **end_address** field values |  |
| EA | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-EA)</span> |  |  |  |  |
| FP | Specifies the fingerprint data |  | String. Example: No Match | Infoblox DHCP summary |  |
| HWTYPE | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-HWTYPE)</span> |  |  |  |  |
| LEASED_IP | Specifies the lease IP address |  | IP address | Infoblox DHCP summary |  |
| MAC_DUID | Specifies the MAC address |  | MAC address | Infoblox DHCP summary |  |
| MAX_DB_OBJECTS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DB_OBJECTS)</span> |  |  |  |  |
| MAX_DHCP_LPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DHCP_LPS)</span> |  |  |  |  |
| MAX_DNS_QPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DNS_QPS)</span> |  |  |  |  |
| MEMBER_IP | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MEMBER_IP)</span> |  |  |  |  |
| Protocol | Specifies the DHCP protocol |  | String. Example: IPV4 | Infoblox DHCP summary |  |
| SFP | Specifies the SFP |  | String. Example: Ubuntu/Debian 5/Knoppix 6 | **os_number_fingerprint_lookup** lookup   
from** /storage/splunk/etc/apps/infoblox/**  
**lookups/os_number_fingerprint_device_**  
**class_map.csv**   
with **OS_NUMBER** value as input |  |
| VIEW | It refers to the DNS view key to map the DNS view through lookup. See <span style="color: #0000ff">[display_name](#Chapter41ReportingDataModel-display_name)</span><span style="color: #0000ff"> </span>field |  | String |  |  |
| date_hour | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_hour)</span> |  |  |  |  |
| date_mday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_mday)</span> |  |  |  |  |
| date_minute | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_minute)</span> |  |  |  |  |
| date_month | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_month)</span> |  |  |  |  |
| date_second | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_second)</span> |  |  |  |  |
| date_wday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_wday)</span> |  |  |  |  |
| date_year | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_year)</span> |  |  |  |  |
| date_zone | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_zone)</span> |  |  |  |  |
| dhcp_utilization_status | Specifies the DHCP utilization status |  | String | Infoblox DHCP summary |  |
| display_name | Specifies the DNS view |  | String | **DNS view lookup** from   
**dns_viewkey_displayname.csv**   
using the **View** field value |  |
| end_address | Specifies the end IP address |  | IP address | Infoblox DHCP summary |  |
| eventtype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-eventtype)</span> |  |  |  |  |
| host | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-host)</span> |  |  |  |  |
| index | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-index)</span> |  |  |  |  |
| info_max_time | <span style="color: #0000ff">[Common summary index fields](#Chapter41ReportingDataModel-info_max_time)</span> |  |  |  |  |
| info_min_time | <span style="color: #0000ff">[Common summary index fields](#Chapter41ReportingDataModel-info_min_time)</span> |  |  |  |  |
| info_search_time | <span style="color: #0000ff">[Common summary index fields](#Chapter41ReportingDataModel-info_search_time)</span> |  |  |  |  |
| linecount | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-linecount)</span> |  |  |  |  |
| members | Specifies the DHCP member |  | String. Example: infoblox.localdomain | Infoblox DHCP summary |  |
| ms_servers | Specifies the MS servers |  | IP address | Infoblox DHCP summary |  |
| orig_host | Specifies the host name of the data source |  | Example: infoblox.com |  | Splunk added default field |
| psrsvd_ct_FREE_  
ADDRESSES | Specifies the count information for FREE_ADDRESSES field | si_dhcp_usage_trend |  |  | Splunk added special field |
| psrsvd_ct_dhcp_utilization | Specifies the count for dhcp_utilization field | si_dhcp_range_utilization  
_trend |  |  | Splunk added special field |
| psrsvd_ct_dynamic_hosts | Specifies the count for dynamic_hosts field | si_dhcp_usage_trend |  |  | Splunk added special field |
| psrsvd_ct_static_hosts | Specifies the count for static_hosts field | si_dhcp_usage_trend |  |  | Splunk added special field |
| psrsvd_ct_v4ack | Specifies the count for v4ack field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_ct_v4decline | Specifies the count for v4decline field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_ct_v4discover | Specifies the count for v4discover field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_ct_v4inform | Specifies the count for v4inform field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_ct_v4leaseactive | Specifies the count for v4leaseactive field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_ct_v4leasequery | Specifies the count for v4leasequery field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_ct_v4leaseunassigned | Specifies the count for v4leaseunassigned field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_ct_v4leaseunknown | Specifies the count for v4leaseunknown field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_ct_v4nak | Specifies the count for   
v4nak field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_ct_v4offer | Specifies the count for v4offer field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_ct_v4release | Specifies the count for v4release field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_ct_v4request | Specifies the count for v4request field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_ct_v6advertise | Specifies the count for v6advertise field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_ct_v6confirm | Specifies the count for v6confirm field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_ct_v6decline | Specifies the count for v6decline field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_ct_v6information_  
request | Specifies the count for v6information_request field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_ct_v6leasequery | Specifies the count for v6leasequery field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_ct_v6leasequery_  
reply | Specifies the count for v6leasequery_reply field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_ct_v6rebind | Specifies the count for v6rebind field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_ct_v6reconfigure | Specifies the count for v6reconfigure field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_ct_v6relay_forward | Specifies the count for v6relay_forward field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_ct_v6relay_reply | Specifies the count for v6relay_reply field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_ct_v6release | Specifies the count for v6release field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_ct_v6renew | Specifies the count for v6renew field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_ct_v6reply | Specifies the count for v6reply field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_ct_v6request | Specifies the count for v6request field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_ct_v6solicit | Specifies the count for v6solicit field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_gc | Here, gc = group count. The count for stats grouping and not scoped to a single field. |  |  |  | Splunk added special field |
| psrsvd_nc_FREE_  
ADDRESSES | Specifies the numerical count for FREE_ADDRESSES field | si_dhcp_usage_trend |  |  | Splunk added special field |
| psrsvd_nc_dhcp_utilization | Specifies the numerical count for dhcp_utilization field | si_dhcp_range_utilization_trend |  |  | Splunk added special field |
| psrsvd_nc_dynamic_hosts | Specifies the numerical count for dynamic_hosts field | si_dhcp_usage_trend |  |  | Splunk added special field |
| psrsvd_nc_static_hosts | Specifies the numerical count for static_hosts field | si_dhcp_usage_trend |  |  | Splunk added special field |
| psrsvd_nc_v4ack | Specifies the numerical count for v4ack field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_nc_v4decline | Specifies the numerical count for v4decline field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_nc_v4discover | Specifies the numerical count for v4discover field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_nc_v4inform | Specifies the numerical count for v4inform field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_nc_v4leaseactive | Specifies the numerical count for v4leaseactive field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_nc_v4leasequery | Specifies the numerical count for v4leasequery field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_nc_v4leaseunassigned | Specifies the numerical count for v4leaseunassigned field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_nc_v4leaseunknown | Specifies the numerical count for v4leaseunknown field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_nc_v4nak | Specifies the numerical count for v4nak field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_nc_v4offer | Specifies the numerical count for v4offer field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_nc_v4release | Specifies the numerical count for v4release field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_nc_v4request | Specifies the numerical count for v4request field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_nc_v6advertise | Specifies the numerical count for v6advertise field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_nc_v6confirm | Specifies the numerical count for v6confirm field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_nc_v6decline | Specifies the numerical count for v6decline field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_nc_v6information_  
request | Specifies the numerical count for v6information_request field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_nc_v6leasequery | Specifies the numerical count for v6leasequery field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_nc_v6leasequery_reply | Specifies the numerical count for v6leasequery_reply field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_nc_v6rebind | Specifies the numerical count for v6rebind field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_nc_v6reconfigure | Specifies the numerical count for v6reconfigure field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_nc_v6relay_forward | Specifies the numerical count for v6relay_forward field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_nc_v6relay_reply | Specifies the numerical count for v6relay_reply field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_nc_v6release | Specifies the numerical count for v6release field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_nc_v6renew | Specifies the numerical count for v6renew field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_nc_v6reply | Specifies the numerical count for v6reply field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_nc_v6request | Specifies the numerical count for v6request field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_nc_v6solicit | Specifies the numerical count for v6solicit field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_sm_FREE_  
ADDRESSES | Specifies the sum for FREE_ADDRESSES field | si_dhcp_usage_trend |  |  | Splunk added special field |
| psrsvd_sm_dhcp_utilization | Specifies the sum for dhcp_utilization field | si_dhcp_range_utilization_trend |  |  | Splunk added special field |
| psrsvd_sm_dynamic_hosts | Specifies the sum for dynamic_hosts field | si_dhcp_usage_trend |  |  | Splunk added special field |
| psrsvd_sm_static_hosts | Specifies the sum for static_hosts field | si_dhcp_usage_trend |  |  | Splunk added special field |
| psrsvd_sm_v4ack | Specifies the sum for v4ack field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_sm_v4decline | Specifies the sum for v4decline field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_sm_v4discover | Specifies the sum for v4discover field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_sm_v4inform | Specifies the sum for v4inform field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_sm_v4leaseactive | Specifies the sum for v4leaseactive field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_sm_v4leasequery | Specifies the sum for v4leasequery field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_sm_v4leaseunassigned | Specifies the sum for v4leaseunassigned field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_sm_v4leaseunknown | Specifies the sum for v4leaseunknown field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_sm_v4nak | Specifies the sum for v4nak field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_sm_v4offer | Specifies the sum for v4offer field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_sm_v4release | Specifies the sum for v4release field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_sm_v4request | Specifies the sum for v4request field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_sm_v6advertise | Specifies the sum for v6advertise field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_sm_v6confirm | Specifies the sum for v6confirm field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_sm_v6decline | Specifies the sum for v6decline field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_sm_v6information_  
request | Specifies the sum for v6information_request field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_sm_v6leasequery | Specifies the sum for v6leasequery field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_sm_v6leasequery_reply | Specifies the sum for v6leasequery_reply field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_sm_v6rebind | Specifies the sum for v6rebind field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_sm_v6reconfigure | Specifies the sum for v6reconfigure field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_sm_v6relay_forward | Specifies the sum for v6relay_forward field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_sm_v6relay_reply | Specifies the sum for v6relay_reply field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_sm_v6release | Specifies th sum for v6release field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_sm_v6renew | Specifies the sum for v6renew field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_sm_v6reply | Specifies the sum for v6reply field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_sm_v6request | Specifies the sum for v6request field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_sm_v6solicit | Specifies the sum for v6solicit field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_v | Here, v = version. This is not scoped to a single field. | si_dhcp_usage_trend,  
si_dhcp_top_lease_client,   
si_dhcp_range_utilization_trend,  
si_dhcp_top_os_by_network, and  
si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_vt_FREE_ADDRESSES | Contains precision of the FREE_ADDRESSES field | si_dhcp_usage_trend |  |  | Splunk added special field |
| psrsvd_vt_dhcp_utilization | Contains precision of the dhcp_utilization field | si_dhcp_range_utilization_trend |  |  | Splunk added special field |
| psrsvd_vt_dynamic_hosts | Contains precision of the dynamic_hosts field | si_dhcp_usage_trend |  |  | Splunk added special field |
| psrsvd_vt_static_hosts | Contains precision of the static_hosts field | si_dhcp_usage_trend |  |  | Splunk added special field |
| psrsvd_vt_v4ack | Contains precision of the v4ack field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_vt_v4decline | Contains precision of the v4decline field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_vt_v4discover | Contains precision of the v4discover field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_vt_v4inform | Contains precision of the v4inform field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_vt_v4leaseactive | Contains precision of the v4leaseactive field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_vt_v4leasequery | Contains precision of the v4leasequery field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_vt_v4leaseunassigned | Contains precision of the v4leaseunassigned field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_vt_v4leaseunknown | Contains precision of the v4leaseunkown field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_vt_v4nak | Contains precision of the v4nak field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_vt_v4offer | Contains precision of the v4offer field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_vt_v4release | Contains precision of the v4release field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_vt_v4request | Contains precision of the v4request field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_vt_v6advertise | Contains precision of the v6advertise field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_vt_v6confirm | Contains precision of the v6confirm field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_vt_v6decline | Contains precision of the v6decline field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_vt_v6information_request | Contains precision of the v6information_request field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_vt_v6leasequery | Contains precision of the v6leasequery field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_vt_v6leasequery_reply | Contains precision of the v6leasequery_reply field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_vt_v6rebind | Contains precision of the v6rebind field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_vt_v6reconfigure | Contains precision of the v6reconfigure field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_vt_v6relay_forward | Contains precision of the v6relay_forward field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_vt_v6relay_reply | Contains precision of the v6relay_reply field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_vt_v6release | Contains precision of the v6release field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_vt_v6renew | Contains precision of the v6renew field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_vt_v6reply | Contains precision of the v6reply field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_vt_v6request | Contains precision of the v6request field | si-search-dhcp-message |  |  | Splunk added special field |
| psrsvd_vt_v6solicit | Contains precision of the v6solicit field | si-search-dhcp-message |  |  | Splunk added special field |
| **report** | **Name of the report that is populating the summary index** |  |  |  |  |
|  | **[DHCP](https://twiki.inca.infoblox.com/do/view/Main/DHCP)** **Message Rate Trend data** | si-search-dhcp-message |  |  |  |
|  | **DHCPv4 Usage Trend data** | si_dhcp_usage_trend |  |  |  |
|  | **[DHCP](https://twiki.inca.infoblox.com/do/view/Main/DHCP)** **Top Lease Clients report data** | si_dhcp_top_lease_client |  |  |  |
|  | **Top Devices Denied an IP Address report data** | si_devices_denied_an_ip_address |  |  |  |
|  | **DHCPv4 Range Utilization Trend** | si_dhcp_range_utilization_trend |  |  |  |
|  | **Device and Device Classes reports data** | si_dhcp_top_os_by_network |  |  |  |
| search_name | <span style="color: #0000ff">[Common summary index fields ](#Chapter41ReportingDataModel-search_name)</span> |  |  |  |  |
| search_now | <span style="color: #0000ff">[Common summary index fields](#Chapter41ReportingDataModel-search_now)</span> |  |  |  |  |
| source | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-source)</span> |  |  |  |  |
| sourcetype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-sourcetype)</span> |  |  |  |  |
| splunk_server | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server)</span> |  |  |  |  |
| splunk_server_group | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server_group)</span> |  |  |  |  |
| start_address | Specifies the start IP address |  | IP address | Infoblox DHCP summary |  |
| timeendpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timeendpos)</span> |  |  |  |  |
| timestartpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timestartpos)</span> |  |  |  |  |
| View | Specifies the network view |  | String. Example: default | Infoblox DHCP summary |  |

## Infoblox DTC Summary

|  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- |
| **Extracted Field Name** | **Description of the field** | **Reports** | **Values/Range** | **Source of Data** | **Remarks** |
| EA | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-EA)</span> |  |  |  |  |
| HWTYPE | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-HWTYPE)</span> |  |  |  |  |
| MAX_DB_OBJECTS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DB_OBJECTS)</span> |  |  |  |  |
| MAX_DHCP_LPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DHCP_LPS)</span> |  |  |  |  |
| MAX_DNS_QPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DNS_QPS)</span> |  |  |  |  |
| MEMBER_IP | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MEMBER_IP)</span> |  |  |  |  |
| date_hour | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_hour)</span> |  |  |  |  |
| date_mday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_mday)</span> |  |  |  |  |
| date_minute | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_minute)</span> |  |  |  |  |
| date_month | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_month)</span> |  |  |  |  |
| date_second | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_second)</span> |  |  |  |  |
| date_wday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_wday)</span> |  |  |  |  |
| date_year | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_year)</span> |  |  |  |  |
| date_zone | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_zone)</span> |  |  |  |  |
| eventtype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-eventtype)</span> |  |  |  |  |
| host | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-host)</span> |  |  |  |  |
| index | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-index)</span> |  |  |  |  |
| info_max_time | <span style="color: #0000ff">[Common summary index fields](#Chapter41ReportingDataModel-info_max_time)</span> |  |  |  |  |
| info_min_time | <span style="color: #0000ff">[Common summary index fields](#Chapter41ReportingDataModel-info_min_time)</span> |  |  |  |  |
| info_search_time | <span style="color: #0000ff">[Common summary index fields](#Chapter41ReportingDataModel-info_search_time)</span> |  |  |  |  |
| linecount | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-linecount)</span> |  |  |  |  |
| Monitor | Specifies the monitor |  | String. Example: https | Infoblox DTC summary |  |
| orig_host | Specifies the host name of the data source |  | Example: infoblox.com |  | Splunk added default field |
| pool | Specifies the Pool |  | String. Example: Pool | Infoblox DTC summary |  |
| psrsvd_ct_available | Specifies the count information for available field | si_adns_resource_pool_availability  
and  
si_smart_dns_resource_availability |  |  | Splunk added special field |
| psrsvd_ct_response_count | Specifies the count information for response_count field | si_dtc_response_distribution |  |  | Splunk added special field |
| psrsvd_ct_unavailable | Specifies the count information for unavailable field | si_adns_resource_pool_availability  
and  
si_smart_dns_resource_availability |  |  | Splunk added special field |
| psrscd_ct_value | Specifies the count information for value field | si_smart_dns_resource_snmp |  |  | Splunk added special field |
| psrsvd_gc | Here, gc = group count. This is the count for stats grouping and it is not scoped to a single field. | si_dtc_response_distribution,  
si_smart_dns_resource_snmp,  
si_adns_resource_pool_availability,   
and  
si_smart_dns_resource_availability |  |  | Splunk added special field |
| psrsvd_nc_available | Specifies the numerical count information for available field | si_adns_resource_pool_availability  
and  
si_smart_dns_resource_availability |  |  | Splunk added special field |
| psrsvd_nc_response_count | Specifies the numerical count information for response_count field | si_dtc_response_distribution |  |  | Splunk added special field |
| psrsvd_nc_unavailable | Specifies the numerical count information for unavailable field | si_adns_resource_pool_availability  
and  
si_smart_dns_resource_availability |  |  | Splunk added special field |
| psrsvd_nc_value | Specifies the numerical count information for value field | si_smart_dns_resource_snmp |  |  | Splunk added special field |
| psrsvd_sm_available | Specifies the sum information for available field | si_adns_resource_pool_availability  
and  
si_smart_dns_resource_availability |  |  | Splunk added special field |
| psrsvd_sm_response_count | Specifies the sum information for response_count field | si_dtc_response_distribution |  |  | Splunk added special field |
| psrsvd_sm_unavailable | Specifies the sum information for unavailable field | si_adns_resource_pool_availability and  
si_smart_dns_resource_availability |  |  | Splunk added special field |
| psrsvd_sm_value | Specifies the sum information for value field | si_smart_dns_resource_snmp |  |  | Splunk added special field |
| psrsvd_v | Here, v = version. This is not scoped to a single field. | si_dtc_response_distribution,  
si_smart_dns_resource_snmp,  
si_adns_resource_pool_availability, and  
si_smart_dns_resource_availability |  |  | Splunk added special field |
| psrsvd_vt_available | Contains precision of the available field | si_adns_resource_pool_availability and  
si_smart_dns_resource_availability |  |  | Splunk added special field |
| psrsvd_vt_response_count | Contains precision of the response_count field | si_dtc_response_distribution |  |  | Splunk added special field |
| psrsvd_vt_unavailable | Contains precision of the unavailable field | si_adns_resource_pool_availability and  
si_smart_dns_resource_availability |  |  | Splunk added special field |
| psrsvd_vt_value | Contains precision of the value field | si_smart_dns_resource_snmp |  |  | Splunk added special field |
| **report** | **Name of the report that populates the summary index** |  |  |  |  |
|  | **DNS Traffic Control Response Distribution Trend data** | si_dtc_response_distribution |  |  |  |
|  | **DNS Traffic Control Resource Pool Availability reports data** | si_adns_resource_pool_availability |  |  |  |
|  | **DNS Traffic Control Resource SNMP reports data** | si_smart_dns_resource_snmp |  |  |  |
|  | **DNS Traffic Control Resource Availability reports data** | si_smart_dns_resource_availability |  |  |  |
| resource | Specifies the resource |  | String. Example: Server | Infoblox DTC summary |  |
| search_name | <span style="color: #0000ff">[Common summary index fields ](#Chapter41ReportingDataModel-search_name)</span> |  |  |  |  |
| search_now | <span style="color: #0000ff">[Common summary index fields](#Chapter41ReportingDataModel-search_now)</span> |  |  |  |  |
| source | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-source)</span> |  |  |  |  |
| sourcetype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-sourcetype)</span> |  |  |  |  |
| splunk_server | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server)</span> |  |  |  |  |
| splunk_server_group | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server_group)</span> |  |  |  |  |
| timeendpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timeendpos)</span> |  |  |  |  |
| timestartpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timestartpos)</span> |  |  |  |  |

## Infoblox System Summary

|  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- |
| **Extracted Field Name** | **Description of the field** | **Reports** | **Values/Range** | **Source of Data** | **Remarks** |
| EA | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-EA)</span> |  |  |  |  |
| HWTYPE | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-HWTYPE)</span> |  |  |  |  |
| MAX_DB_OBJECTS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DB_OBJECTS)</span> |  |  |  |  |
| MAX_DHCP_LPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DHCP_LPS)</span> |  |  |  |  |
| MAX_DNS_QPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DNS_QPS)</span> |  |  |  |  |
| MEMBER | Specifies the member |  | String. Example: infoblox.localdomain: inbound | Evaluated from **host** and **sys_report_id** field values |  |
| MEMBER_IP | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MEMBER_IP)</span> |  |  |  |  |
| date_hour | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_hour)</span> |  |  |  |  |
| date_mday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_mday)</span> |  |  |  |  |
| date_minute | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_minute)</span> |  |  |  |  |
| date_month | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_month)</span> |  |  |  |  |
| date_second | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_second)</span> |  |  |  |  |
| date_wday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_wday)</span> |  |  |  |  |
| date_year | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_year)</span> |  |  |  |  |
| date_zone | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_zone)</span> |  |  |  |  |
| eventtype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-eventtype)</span> |  |  |  |  |
| host | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-host)</span> |  |  |  |  |
| index | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-index)</span> |  |  |  |  |
| info_max_time | <span style="color: #0000ff">[Common summary index fields](#Chapter41ReportingDataModel-info_max_time)</span> |  |  |  |  |
| info_min_time | <span style="color: #0000ff">[Common summary index fields](#Chapter41ReportingDataModel-info_min_time)</span> |  |  |  |  |
| info_search_time | <span style="color: #0000ff">[Common summary index fields](#Chapter41ReportingDataModel-info_search_time)</span> |  |  |  |  |
| linecount | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-linecount)</span> |  |  |  |  |
| orig_host | Specifies the host name of the data source |  | Example: infoblox.com |  | Splunk added default field |
| psrsvd_ct_CPU_PERCENT | Specifies the count information for the CPU_PERCENT field | si_cpu_usage |  |  | Splunk added special field |
| psrsvd_ct_MEMORY_PERCENT | Specifies the count information for the MEMORY_PERCENT field | si_memory_utilization |  |  | Splunk added special field |
| psrsvd_ct_TRAF_VALUE | Specifies the count information for TRAF_VALUE field | si_traffic_rate |  |  | Splunk added special field |
| psrsvd_gc | Here, gc = group count. This is the count for a stats grouping and it is not scoped to a single field. | si_memory_utilization,  
si_traffic_rate, and  
si_cpu_usage |  |  | Splunk added special field |
| psrsvd_nc_CPU_PERCENT | Specifies the numerical count information for CPU_PERCENT field | si_cpu_usage |  |  | Splunk added special field |
| psrsvd_nc_MEMORY_PERCENT | Specifies the numerical count information for MEMORY_PERCENT field | si_memory_utilization |  |  | Splunk added special field |
| psrsvd_nc_TRAF_VALUE | Specifies the numerical count information for TRAF_VALUE field | si_traffic_rate |  |  | Splunk added special field |
| psrsvd_sm_CPU_PERCENT | Specifies the sum for CPU_PERCENT field | si_cpu_usage |  |  | Splunk added special field |
| psrsvd_sm_MEMORY_PERCENT | Specifies the sum for MEMORY_PERCENT field | si_memory_utilization |  |  | Splunk added special field |
| psrsvd_sm_TRAF_VALUE | Specifies the sum for TRAF_VALUE field | si_traffic_rate |  |  | Splunk added special field |
| psrsvd_v | Here, v = version. This is not scoped to a single field. | si_memory_utilization,  
si_traffic_rate, and  
si_cpu_usage |  |  | Splunk added special field |
| psrsvd_vt_CPU_PERCENT | Contains precision of the CPU_PERCENT field | si_cpu_usage |  |  | Splunk added special field |
| psrsvd_vt_MEMORY_PERCENT | Contains precision of the MEMORY_PERCENT field | si_memory_utilization |  |  | Splunk added special field |
| psrsvd_vt_TRAF_VALUE | Contains precision of the TRAF_VALUE field | si_traffic_rate |  |  | Splunk added special field |
| **report** | **Specifies the name of the report that is populating the summary index** |  |  |  |  |
|  | **Index Disk Usage Report Data** | si_index_disk_usage |  |  |  |
|  | **Memory Utilization Trend data** | si_memory_utilization |  |  |  |
|  | **Traffic Rate by Member report data** | si_traffic_rate |  |  |  |
|  | **CPU Utilization Trend data** | si_cpu_usage |  |  |  |
| search_name | <span style="color: #0000ff">[Common summary index fields ](#Chapter41ReportingDataModel-search_name)</span> |  |  |  |  |
| search_now | <span style="color: #0000ff">[Common summary index fields](#Chapter41ReportingDataModel-search_now)</span> |  |  |  |  |
| source | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-source)</span> |  |  |  |  |
| sourcetype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-sourcetype)</span> |  |  |  |  |
| splunk_server | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server)</span> |  |  |  |  |
| splunk_server_group | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server_group)</span> |  |  |  |  |
| timeendpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timeendpos)</span> |  |  |  |  |
| timestartpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timestartpos)</span> |  |  |  |  |

## Infoblox Security Summary

|  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- |
| **Extracted Field Name** | **Description of the field** | **Reports** | **Values/Range** | **Source of Data** | **Remarks** |
| ACTIVE_COUNT | Specifies the active count |  | Integer | Infoblox security summary |  |
| BLOCK_END | Specifies the block end IP address |  | Integer | Infoblox security summary |  |
| BLOCK_START | Specifies the block start IP address |  | Integer | Infoblox security summary |  |
| DNST_CATEGORY | Specifies the destination category |  | String | **atp_rule_sid_lookup** lookup from **/tmp/reporting_atp_conf/atp_rule_sid_lookup.csv** with **RULE_SID** value as input |  |
| EA | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-EA)</span> |  |  |  |  |
| HWTYPE | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-HWTYPE)</span> |  |  |  |  |
| MAX_DB_OBJECTS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DB_OBJECTS)</span> |  |  |  |  |
| MAX_DHCP_LPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DHCP_LPS)</span> |  |  |  |  |
| MAX_DNS_QPS | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MAX_DNS_QPS)</span> |  |  |  |  |
| MEMBER_IP | <span style="color: #0000ff">[Common Extracted fields](#Chapter41ReportingDataModel-MEMBER_IP)</span> |  |  |  |  |
| NAT_STATUS | Specifies the NAT status |  | String | Infoblox security summary |  |
| RULE_DESCRIPTION | Specifies the rule description |  | String. Example: This rule drops unexpected OSPF packets when OSPF is disabled. | **atp_rule_sid_lookup** lookup from **/tmp/reporting_atp_conf/atp_rule_sid_lookup.csv** with **RULE_SID** value as input |  |
| RULE_NAME | Specifies the rule name |  | String. Example: DROP OSPF unexpected | **atp_rule_sid_lookup** lookup from **/tmp/reporting_atp_conf/atp_rule_sid_lookup.csv** with **RULE_SID** value as input |  |
| RULE_SID | Specifies the rule SID |  | Integer | Infoblox security summary |  |
| SOURCE_IP | Specifies the source IP |  | IP address | Infoblox security summary |  |
| SOURCE_PORT | Specifies the source port |  | Integer | Infoblox security summary |  |
| date_hour | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_hour)</span> |  |  |  |  |
| date_mday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_mday)</span> |  |  |  |  |
| date_minute | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_minute)</span> |  |  |  |  |
| date_month | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_month)</span> |  |  |  |  |
| date_second | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_second)</span> |  |  |  |  |
| date_wday | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_wday)</span> |  |  |  |  |
| date_year | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_year)</span> |  |  |  |  |
| date_zone | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-date_zone)</span> |  |  |  |  |
| eventtype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-eventtype)</span> |  |  |  |  |
| host | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-host)</span> |  |  |  |  |
| index | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-index)</span> |  |  |  |  |
| info_max_time | <span style="color: #0000ff">[Common summary index fields](#Chapter41ReportingDataModel-info_max_time)</span> |  |  |  |  |
| info_min_time | <span style="color: #0000ff">[Common summary index fields](#Chapter41ReportingDataModel-info_min_time)</span> |  |  |  |  |
| info_search_time | <span style="color: #0000ff">[Common summary index fields](#Chapter41ReportingDataModel-info_search_time)</span> |  |  |  |  |
| linecount | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-linecount)</span> |  |  |  |  |
| orig_host | Specifies the host name of the data source |  | Example: infoblox.com |  | Splunk added default field |
| **report** | **Name of the report that is populating the summary index** |  |  |  |  |
|  | **DNS Tunneling Activity Reports data** | si_dns_tunneling_activity |  |  |  |
| search_name | <span style="color: #0000ff">[Common summary index fields ](#Chapter41ReportingDataModel-search_name)</span> |  |  |  |  |
| search_now | <span style="color: #0000ff">[Common summary index fields](#Chapter41ReportingDataModel-search_now)</span> |  |  |  |  |
| source | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-source)</span> |  |  |  |  |
| sourcetype | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-sourcetype)</span> |  |  |  |  |
| splunk_server | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server)</span> |  |  |  |  |
| splunk_server_group | <span style="color: #0000ff">[Splunk Default field](#Chapter41ReportingDataModel-splunk_server_group)</span> |  |  |  |  |
| timeendpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timeendpos)</span> |  |  |  |  |
| timestartpos | <span style="color: #0000ff">[Common extracted fields](#Chapter41ReportingDataModel-timestartpos)</span> |  |  |  |  |

# When to Update

You must update this document in the following scenarios of the reporting data model:

- When new indexes are introduced.
- When new fields are added to or deleted from existing indexes.
- Cron schedules of existing summary indexes are modified.
- Cron schedules are added for a new summary.

# How to Update

Please read the following before you update this document:

1. Populate the required index with data in the Grid setup.
2. Use the following command to get a list of all fields within each index:
3. index=ib_xxxx | fieldsummary
4. Add those lists of fields to the table in the index.
5. Determine sample field values from search results.
6. Manually figure out the source data path of each field.

For existing fields go through:

- *default/props.conf*
- *default/transforms.conf*
- *default/savedsearches.conf configuration files from IBRA code*
- *products/reporting/server/src/pyutil/reporting_config_writer_util.py from NIOS code.*

The following path is commonly found for file based (like .csv, .txt, .log) extractions in each forwarder:* /infoblox/var/reporting/*   
Lookup files path in an indexer:*/storage/splunk/etc/apps/infoblox/lookups/*