extracting values from fields in metrics

Be_JAR — Wed, 26 Jun 2024 13:57:56 GMT

Hello.

I am working with opentelemetry metrics. I have a metric type index, and the format of the payload I receive is like this:

example payload :

{"deployment.environment":"entorno-pruebas","k8s.cluster.name":"splunk-otel","k8s.namespace.name":"default","k8s.node.name":"minikube","k8s.pod.name":"my-otel-demo-emailservice-fc5bc4c5f-jxzqz","k8s.pod.uid":"5fe1ada8-8baa-4960-b873-381b475b2b26","metric_type":"Gauge","os.type":"linux","metric_name:k8s.pod.filesystem.usage":491520}

I need a search that retrieves the various values of the k8s.pod.name field. I'm trying different variations of the search, but I can't get it:

|mstats avg(_value) as VAL WHERE index=otel_k8s_metrics metric_name="metric_name:k8s.pod.filesystem.usage*" |spath input=_raw path=k8s.pod.name output=k8s.pod.name |stats values(k8s.pod.name) as k8s.pod.name |table k8s.pod.name

Does anyone have any idea why it doesn't work. Metrics type indexes support spath

I appreciate any ideas

JAR

Re: extracting values from fields in metrics

KendallW — Mon, 01 Jul 2024 04:51:35 GMT

Hi @Be_JAR In your first screenshot, it looks like the k8s.pod.name field is already being extracted correctly? It seems to get extracted correctly when using this run-anywhere search using the payload you provided:

| makeresults | eval _raw="{ \"deployment.environment\":\"entorno-pruebas\", \"k8s.cluster.name\":\"splunk-otel\", \"k8s.namespace.name\":\"default\", \"k8s.node.name\":\"minikube\", \"k8s.pod.name\":\"my-otel-demo-emailservice-fc5bc4c5f-jxzqz\", \"k8s.pod.uid\":\"5fe1ada8-8baa-4960-b873-381b475b2b26\", \"metric_type\":\"Gauge\", \"os.type\":\"linux\", \"metric_name:k8s.pod.filesystem.usage\":491520 }" | spath | stats values(k8s.pod.name) as k8s.pod.name

topic Re: extracting values ​​from fields in metrics in Getting Data In

extracting values ​​from fields in metrics

Re: extracting values ​​from fields in metrics

topic Re: extracting values from fields in metrics in Getting Data In

extracting values from fields in metrics

Re: extracting values from fields in metrics