uberAgent

Standby/Resume Duration Metrics

Standby Detail

uberAgent collects information about each standby/resume like duration, the reason for waking up as well as pages written to the hibernation file.

Note

This metric is only available on client operating systems.

Details

  • Source type: uberAgent:OnOffTransition:StandbyDetail2
  • Used in dashboards: Standby/Resume Duration
  • Enabled through configuration setting: StandbyDetail
  • Related configuration settings: n/a
  • Supported platform: Windows

List of Fields in the Raw Agent Data

Field Description Data type Unit Example
SleepTime Time the sleep started. String   2018-07-31 19:02:37.582 +0200
WakeTime Time the wake completed. String   2018-07-32 07:31:58.434 +0200
EnterStandbyMs Duration of the standby process. Number ms 5737
ResumeFromStandbyMs Duration of the resume process. Number ms 1269
DriverInitDuration Duration of driver initialization at resume. Number ms 897
BiosInitDuration Duration of BIOS initialization at resume. Number ms 0
HiberWriteDuration Duration of write to hibernation file. Number ms 8034
HiberReadDuration Duration of read from hibernation file. Number ms 4419
HiberPagesWritten Memory pages written to the hibernation file. Number   738245
Attributes n/a Number   33571073
TargetState Target sleep state. Possible values: 0-7. For a string representation see the calculated field TargetStateDisplayName. Number   5
EffectiveState Actual sleep state. Possible values: 0-7. For a string representation see the calculated field EffectiveStateDisplayName. Number   5
WakeSourceType Source of a wake up (what woke the machine up?). Possible values: 0-6. For a string representation see the calculated field WakeSourceTypeDisplayName. Number   1
WakeSourceTextLength Number of characters in the field WakeSourceText. Number   125
WakeSourceText Description of the source of a wake up String   Windows will execute ‘NT TASK\Microsoft\Windows\UpdateOrchestrator\Reboot’ scheduled task that requested waking the computer.
WakeTimerOwnerLength Number of characters in the field WakeTimerOwner. Number   52
WakeTimerContextLength Number of characters in the field WakeTimerContext. Number   18
NoMultiStageResumeReason n/a Number   0
WakeTimerOwner If a wake up was caused by a timer: owner of the timer. String   \Device\HarddiskVolume4\Windows\System32\svchost.exe
WakeTimerContext If a wake up was caused by a timer: additional information. String   SystemEventsBroker

List of Calculated Fields

Field Description Data type Unit Example Where available
TargetStateDisplayName String representation of the field TargetState. Possible values: undefined, S0/working, S1, S2, S3/standby, Hibernate, Shutdown, Maximum enumeration value. String   Hibernate Splunk data model, Splunk SPL
EffectiveStateDisplayName String representation of the field EffectiveState. Possible values: undefined, S0/working, S1, S2, S3/standby, Hibernate, Shutdown, Maximum enumeration value. String   Hibernate Splunk data model, Splunk SPL
WakeSourceTypeDisplayName String representation of the field WakeSourceType. Possible values: unknown, Power Button, S4 Doze to Hibernate, Device, Device or Timer, Timer. String   Timer Splunk data model, Splunk SPL
Standby/Resume Duration Metrics