Documentation

Contents
Contents

Standby/Resume Duration Metrics

Standby Detail

uberAgent collects information about each standby/resume like duration, the reason for waking up as well as pages written to the hibernation file.

Details

  • Source type: uberAgent:OnOffTransition:StandbyDetail2
  • Used in dashboards: Standby/Resume Duration
  • Enabled through configuration setting: StandbyDetail
  • Related configuration settings: n/a

List of Fields in the Raw Agent Data

Field Description Data type Unit Example
SleepTime Time the sleep started String 2018-07-31 19:02:37.582 +0200
WakeTime Time the wake completed String 2018-07-32 07:31:58.434 +0200
EnterStandbyMs Duration of the standby process Number ms 5737
ResumeFromStandbyMs Duration of the resume process Number ms 1269
DriverInitDuration Duration of driver initialization at resume Number ms 897
BiosInitDuration Duration of BIOS initialization at resume Number ms 0
HiberWriteDuration Duration of write to hibernation file Number ms 8034
HiberReadDuration Duration of read from hibernation file Number ms 4419
HiberPagesWritten Memory pages written to the hibernation file Number 738245
Attributes n/a Number 33571073
TargetState Target sleep state. Possible values: 0-7. For a string representation see the calculated field TargetStateDisplayName. Number 5
EffectiveState Actual sleep state. Possible values: 0-7. For a string representation see the calculated field EffectiveStateDisplayName. Number 5
WakeSourceType Source of a wake up (what woke the machine up?). Possible values: 0-6. For a string representation see the calculated field WakeSourceTypeDisplayName. Number 1
WakeSourceTextLength Number of characters in the field WakeSourceText Number 125
WakeSourceText Description of the source of a wake up String Windows will execute ‘NT TASK\Microsoft\Windows\UpdateOrchestrator\Reboot’ scheduled task that requested waking the computer.
WakeTimerOwnerLength Number of characters in the field WakeTimerOwner Number 52
WakeTimerContextLength Number of characters in the field WakeTimerContext Number 18
NoMultiStageResumeReason n/a Number 0
WakeTimerOwner If a wake up was caused by a timer: owner of the timer String \Device\HarddiskVolume4\Windows\System32\svchost.exe
WakeTimerContext If a wake up was caused by a timer: additional information String SystemEventsBroker

List of Calculated Fields

Field Description Data type Unit Example Where available
TargetStateDisplayName String representation of the field TargetState. Possible values: undefined, S0 / working, S1, S2, S3 / standby, Hibernate, Shutdown, Maximum enumeration value String Hibernate Splunk data model, Splunk SPL
EffectiveStateDisplayName String representation of the field EffectiveState. Possible values: undefined, S0 / working, S1, S2, S3 / standby, Hibernate, Shutdown, Maximum enumeration value String Hibernate Splunk data model, Splunk SPL
WakeSourceTypeDisplayName String representation of the field WakeSourceType. Possible values: unknown, Power Button, S4 Doze to Hibernate, Device, Device or Timer, Timer String Timer Splunk data model, Splunk SPL