topic Re: Storing the correct host dimension with mcollect in Getting Data In

Storing the correct host dimension with mcollect

JustinSC — Tue, 23 Feb 2021 18:28:05 GMT

I've got some events I'm converting to metrics using mcollect with a scheduled report. Does anyone know how to get the metrics to store the original host from the logs instead of whichever indexer they get sent to?

This is the query I'm using to populate the metrics:

sourcetype=mysourcetype host=* "Events to count" | bin _time span=1m | stats count AS _value BY _time, host | eval metric_name="My.Metric.Name" | mcollect index="prod_metrics"

The host field in the metrics ends up being a random indexer from our cluster. I know I could always rename host as server, but if possible I'd like to use the expected field name since all our other natively populated metrics are by host.

Re: Storing the correct host dimension with mcollect

andreasz — Wed, 18 Aug 2021 12:28:18 GMT

Same problem her.
Tried everything:

host=host

host=$host$

host={host}

...

Re: Storing the correct host dimension with mcollect

JustinSC — Wed, 18 Aug 2021 15:25:56 GMT

I never came up with a solution. I stopped using mcollect and now use the Summary Indexing feature with Metrics index type, which I believe requires Splunk 8.1.

For some reason I never setup any metrics to use a host dimension, but perhaps this feature preserves it. I believe something like this would work, or at least it's worth a shot:

sourcetype=mysourcetype host=* "Events to count" | timechart limit=0 span=1m count by host | untable _time host "My.Metric.Name"