topic Re: using mcollect on contionous basis in Splunk Enterprise

using mcollect on contionous basis

Silah — Sat, 23 Nov 2024 14:49:42 GMT

Hi Folks

I've been using mcollect to collect metrics from the events in my indexes and I thought if I set up an alert with the mcollect part in the search, it would automatically collect the metrics every X minutes but that doesn't seem to be working, the metrics are only collected when I run the search manually.

Any suggestions to how I can make mcollect just automatically collect the metrics I am looking for ?

Thanks

Re: using mcollect on contionous basis

PickleRick — Sat, 23 Nov 2024 15:36:20 GMT

Are you sure the user for which the search is scheduled has appropriate capabilities to run mcollect and access to the destination index?

Re: using mcollect on contionous basis

Silah — Sat, 23 Nov 2024 19:23:10 GMT

I think so. I considered permissions and tried it in a lab setting as the admin user and it was the same result.

Besides, it works fine when the same user does it manually so I wouldn't have thought it would be any different for an automated one

Re: using mcollect on contionous basis

PickleRick — Sat, 23 Nov 2024 21:37:01 GMT

If this is the only thing modifying your metrics index you could verify whether the data is not mcollected at all or just "mistimed".

Run

| mstats count(*) where index=<your_metrics_index>
| transpose 0
| stats sum("row 1") as total

over all-time before and after the scheduled search runs and verify the counts

Re: using mcollect on contionous basis

Silah — Tue, 26 Nov 2024 15:16:21 GMT

I do feel a bit stupid now..

My Cron was wrong. The method was perfectly sane.

I did struggle to find any actual documentation to say that this was a way of doing it, so I hope this question will help future searchers determine that.

Thanks for helping my grey matter along