Docs/Connect & Publish/Timebase Historian
Infohub (Flow)Concept

Timebase Historian

Reading Flow Software's own time series database — datasets, TLS, and the identity provider.

Updated 15 Oct 2026Infohub Docs

Timebase is Flow Software's own time series historian — a NoSQL database built for manufacturing operations data. The Timebase Historian connector lets Infohub read from it.

If you are deploying Timebase itself, its own documentation is the authority; this article covers only the Infohub side of the connection.

Note

Timebase has its own knowledge base. For installing, configuring, and operating Timebase — components, collectors, Explorer, Pulse, licensing — see docs.timebase.flow-software.com. This page assumes Timebase is already running and you want Infohub to read it.

Connection properties#

Property Notes
Host Timebase Historian host
Port Historian port
Use TLS Encrypt the connection to the historian
Use Authentication Whether the historian requires authentication
IdP Host Identity provider host
IdP Port Identity provider port
Use TLS (IdP) Encrypt the connection to the identity provider
IdP Client Client identifier
IdP Client Secret Client secret, stored encrypted
Dataset Which Timebase dataset to read

Per-measure, there is a single property: Tagname.

That simplicity is the point. Where a historian connector needs overlap, scaling, rollover, and filter properties to paper over decades of accumulated variation, Timebase was designed for this job and the connection carries the complexity instead of each measure.

Two endpoints, not one#

Unlike most connectors, this one talks to two services: the historian itself, and an identity provider that issues the credentials to reach it.

That means two host-and-port pairs, two TLS settings, and two things that must be reachable from the Platform hosting the connection. When a connection fails, establish which of the two is the problem before changing anything — an unreachable identity provider and an unreachable historian both present as "cannot connect".

Use Authentication gates the identity provider entirely. Where Timebase is configured without authentication — an isolated evaluation environment, typically — the IdP properties are not needed. For anything beyond evaluation, authentication should be on.

Client credentials#

IdP Client and IdP Client Secret are a client credentials pair issued by the Timebase identity layer, not a user's login. The secret is stored encrypted on the connection.

Practical points:

  • Create a dedicated client for Infohub rather than reusing one belonging to a person or another application. It can then be granted exactly the read access it needs and revoked without affecting anything else.
  • Grant read-only access. Infohub never writes to Timebase through this connector.
  • Record the client identifier somewhere alongside your other integration credentials, so that when it is eventually rotated, whoever does it knows Infohub depends on it.
Important

Credential rotation will break the connection silently. When the client secret is rotated in Timebase, the Infohub connection keeps the old one and starts failing. Nothing in Infohub knows a rotation happened. Include "update the Infohub connection" in whatever process rotates these credentials, and verify retrieval afterwards.

Datasets#

Timebase organises data into datasets, and the connection targets one.

If you need to read from several datasets, create one connection per dataset. That is the intended shape, and it has the useful side effect of making the model's dependencies explicit: you can see at a glance which parts of the plant model read which dataset.

Getting the dataset wrong produces a connection that succeeds and a namespace that is either empty or contains entirely unexpected tags — a good early signal to check this property rather than the credentials.

TLS#

There are two independent TLS settings, one per endpoint. Enable both for anything that is not a throwaway evaluation.

Because the two are separate, a common misconfiguration is encrypting one leg and not the other. Check both when reviewing a connection, and remember that the certificate trust applies to the machine hosting the connection — the Platform host — not to the workstation where Flow Config runs.

Tag names#

Per-measure configuration is a single Tagname. Browse the namespace to select it rather than typing.

Browsing here is a particularly efficient test, because it exercises the whole chain at once: network path to the identity provider, credentials, token issue, network path to the historian, TLS on both legs, and the dataset selection. If browsing returns tags, the connection is genuinely working.

Retrieval#

Retrieve at the Tag interval and aggregate in Infohub, as with any source. You keep the raw values, and your aggregation rules stay uniform across every source in the model. See Retrieved Measures.

Writing Infohub results back to Timebase#

Asked directly by integrators: can Infohub's calculated measures be written into Timebase, so the historian carries the derived values alongside the raw ones?

The honest answer for 7.2.0: there is no Timebase data consumer — this connector reads only. The alternatives, in order of preference:

  • Publish via MQTT/Sparkplug to a broker a Timebase Collector already logs from — Infohub's MQTT consumer out, Timebase's collection in. This is the supported composition today, and it keeps Timebase's ingest on its own front door.
  • Let the consuming system read the derived values from Infohub (API or consumer) rather than insisting they live in Timebase.

If the requirement is strategic rather than tactical, raise it as a product request — it is a known and reasonable ask.

Diagnosing#

Symptom Check
Cannot connect Determine whether the historian or the identity provider is unreachable — both look the same
Authentication fails IdP client and secret; whether the secret has been rotated in Timebase
Connects but namespace is empty Wrong Dataset, or the client has no read access to it
Namespace shows unexpected tags Wrong Dataset
Worked, then stopped with no config change Client secret rotated, or a certificate expired
TLS handshake failure One of the two TLS settings, and trust on the Platform host
Works in Flow Config, fails deployed Certificate trust or network path differs on the Platform host
esc
↑↓ navigate · ↵ open · ⌘K anywhere