topic Re: Add-on Builder and Metric Indexes in All Apps and Add-ons

Add-on Builder and Metric Indexes- Why aren't events showing up?

davidoff96 — Thu, 06 Oct 2022 14:28:04 GMT

Hello,

I have to manipulate some data from an api, and send those events to splunk. One set of the api has to go to a normal index, but a subset of the data has to go to a metrics index, which is defined as an input in the add-on configuration.

However, when I try to send events to the metrics, I don't get anything showing up there. I have tried the following:

Prepending "metric_name:" to the field name for the metric
Making a new add-on to only send data to metrics (very simple create an event and send it)
In that same add-on, create the event, and send it to the index defined in the config, and defined my metrics index in that config

None of these worked. Is there a special way to send these to metrics indexes?

Re: Add-on Builder and Metric Indexes

johnhuang — Thu, 06 Oct 2022 01:42:22 GMT

How are you ingesting the metrics? If you're using HEC, make sure you format it correctly and send it to the correct rest api endpoint url.

https://docs.splunk.com/Documentation/SplunkCloud/9.0.2208/Metrics/GetMetricsInOther

Re: Add-on Builder and Metric Indexes

davidoff96 — Thu, 06 Oct 2022 14:21:28 GMT

This is through the add-on builder. When I send the metric through to a normal index, it looks like this:

And my code for generating it looks like this:

data = {
'metric_name:tests_performed:testing': 4
}

event = helper.new_event(source=helper.get_input_type(), index='test-metrics', sourcetype=helper.get_sourcetype(), data=json.dumps(data))
ew.write_event(event)

Where index test-metrics is an index I have set up with the metrics type

Re: Add-on Builder and Metric Indexes- Why aren't events showing up?

davidoff96 — Thu, 06 Oct 2022 21:35:11 GMT

Alright - the issue was that the sourcetype for the metrics events had to have "INDEXED_EXTRACTIONS=json" in the props.conf. Once I had changed that, I was able to see those values in the metrics index.