Is there a best practice for using a time dimension with _metrics Data?

jordanking1992 — Wed, 23 Mar 2022 04:03:56 GMT

Hello,

Working with a team that is sending some custom paramters via metrics data. They are trying to include a dimension that contains a data, but Splunk is not accepting of the date.

release:1,component:test,team:TestTeam,repo_branch:master,version:3,eventTimestamp:2022-03-22T14:46:41.048881800

My guess is that Splunk doesn't like the colon's in the timestamp but a bit unsure. The team wants to be able to send time within the metrics for later analysis using eval commands after indexing.

Is there a best practice for including a time dimension/value within metrics data? (i.e epoch/UNIX time)

Re: Is there a best practice for using a time dimension with _metrics Data?

ITWhisperer — Wed, 23 Mar 2022 06:43:04 GMT

You should be able to configure the timestamp recognition for your sourcetype to match the format used in your messages

https://docs.splunk.com/Documentation/Splunk/8.2.5/Data/Configuretimestamprecognition

topic Re: Is there a best practice for using a time dimension with _metrics Data? in Getting Data In

Is there a best practice for using a time dimension with _metrics Data?

Re: Is there a best practice for using a time dimension with _metrics Data?