<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: metrics - individual events in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/metrics-individual-events/m-p/368903#M66984</link>
    <description>&lt;P&gt;&lt;CODE&gt;mstats&lt;/CODE&gt; allows the use of the &lt;CODE&gt;latest&lt;/CODE&gt; function, which seems like it would give you what you’re looking for.&lt;/P&gt;</description>
    <pubDate>Sat, 30 Dec 2017 16:18:29 GMT</pubDate>
    <dc:creator>micahkemp</dc:creator>
    <dc:date>2017-12-30T16:18:29Z</dc:date>
    <item>
      <title>metrics - individual events</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/metrics-individual-events/m-p/368902#M66983</link>
      <description>&lt;P&gt;Hi Splunkers,&lt;/P&gt;

&lt;P&gt;We are evaluating moving to metrics events for our existing apps. In our apps, we have to display the latest value of the corresponding tag by time.&lt;/P&gt;

&lt;P&gt;From documentation, we find that we might not be able to do it &lt;BR /&gt;
Source: &lt;A href="https://docs.splunk.com/Documentation/Splunk/7.0.1/Metrics/Search"&gt;https://docs.splunk.com/Documentation/Splunk/7.0.1/Metrics/Search&lt;/A&gt; &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;1. You cannot search metrics data for individual metric events. 
2. You cannot use automatic lookups with metrics data. This is because automatic lookups are applied to individual events, whereas metrics are analyzed as an aggregate.
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Please suggest if there are any work-arounds.&lt;/P&gt;</description>
      <pubDate>Sat, 30 Dec 2017 12:50:11 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/metrics-individual-events/m-p/368902#M66983</guid>
      <dc:creator>ykpramodhcbt</dc:creator>
      <dc:date>2017-12-30T12:50:11Z</dc:date>
    </item>
    <item>
      <title>Re: metrics - individual events</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/metrics-individual-events/m-p/368903#M66984</link>
      <description>&lt;P&gt;&lt;CODE&gt;mstats&lt;/CODE&gt; allows the use of the &lt;CODE&gt;latest&lt;/CODE&gt; function, which seems like it would give you what you’re looking for.&lt;/P&gt;</description>
      <pubDate>Sat, 30 Dec 2017 16:18:29 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/metrics-individual-events/m-p/368903#M66984</guid>
      <dc:creator>micahkemp</dc:creator>
      <dc:date>2017-12-30T16:18:29Z</dc:date>
    </item>
  </channel>
</rss>

