topic Re: Routing Metric events to null queue in Getting Data In

Routing Metric events to null queue

markhvesta — Tue, 18 Jan 2022 19:52:19 GMT

I am trying to route metric type events to a null queue to avoid indexing them but they are still coming through. Any ideas if there is a special way to do this?

props.conf:

[azr_proda_metrics]
TRANSFORMS-set= kubenullmetrics

transforms.conf:

[kubenullmetrics]
REGEX=metric_name=kube.cluster.cpu.request| metric_name=kube.cluster.memory.request

DEST_KEY=queue
FORMAT=nullQueue

Re: Routing Metric events to null queue

psla — Mon, 02 Sep 2024 11:40:16 GMT

Any ideas how it can be achieved?

Re: Routing Metric events to null queue

DanielPi — Mon, 02 Sep 2024 14:03:05 GMT

Hi @psla ,

I’m a Community Moderator in the Splunk Community.

This question was posted 2 years ago, so it might not get the attention you need for your question to be answered. We recommend that you post a new question so that your issue can get the visibility it deserves. To increase your chances of getting help from the community, follow these guidelines in the Splunk Answers User Manual when creating your post.

Thank you!

Re: Routing Metric events to null queue

psla — Tue, 03 Sep 2024 07:19:05 GMT

I think I got the attention, because it's on the top on the list.

But why should I create another duplicate question? This one describes exactly what I need, and it's still not resolved. Also, guidelines say: "If no one else has asked your question, navigate to https://community.splunk.com and click Ask a Question, next to the search bar."

Re: Routing Metric events to null queue

PickleRick — Tue, 03 Sep 2024 10:19:19 GMT

Maybe so that you can show _your_ config, _your_ data and say what exactly does or doesn't work in your case. 😉

Re: Routing Metric events to null queue

psla — Tue, 03 Sep 2024 10:34:04 GMT

I'm referring to the original post. @markhvesta said that his transforms are not working for metrics data. I have the same issue (metric names are of course different). So, configuration is already here, I don't have to paste my configuration. Regex is working (tested on regex101).

And the main question in this post is "Any ideas if there is a special way to do this [for metrics data]?"

Re: Routing Metric events to null queue

PickleRick — Tue, 03 Sep 2024 11:04:49 GMT

So everything is the same except the metrics are different, the data is different and generally we don't know what and why "doesn't work", right?

But seriously. The data is important here as well as what your transform looks like.

Look at the Masa diagrams https://community.splunk.com/t5/Getting-Data-In/Diagrams-of-how-indexing-works-in-the-Splunk-platform-the-Masa/m-p/590774

I haven't worked with metrics much but I'd say metric schema is invoked after transforms so you need to filter your data by raw event contents.