https://community.splunk.com/t5/Getting-Data-In/Can-I-use-the-collect-command-to-write-metrics-data-to-a-metrics/m-p/522256#M88185 <P>yeeeeeeeeeeeeeeeeeees!</P> Wed, 30 Sep 2020 13:05:26 GMT andrewtrobec 2020-09-30T13:05:26Z https://community.splunk.com/t5/Getting-Data-In/Can-I-use-the-collect-command-to-write-metrics-data-to-a-metrics/m-p/522219#M88182 <P>Hello,</P><P>I am using Splunk Enterprise 7.3.2. and I have structured event data within an events index that I am trying to convert into metrics data so that I can store it in a metrics index.&nbsp; I am basing my analysis on the following topic:&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/7.3.2/Metrics/GetMetricsInOther" target="_self">Get metrics in from other sources</A>.</P><P>I've managed to create a search that converts my event data into the format that is required by the metrics_csv sourcetype, after which I run the collect command to push the data:<BR /><BR />| collect index="metrics_index" sourcetype="metrics_csv"</P><P>One thing to note is that when I rename my metric value field to _value, the field disappears from the statistics table.</P><P>Once the search has completed I am unable to access that data using mstats and mcatalog commands on the metrics index.</P><P>Is what I am trying to do possible?</P><P>To test whether the format was correct I exported the search results and indexed them by hand.&nbsp; This worked.</P><P>Thank you and best regards,</P><P>Andrew</P> Wed, 30 Sep 2020 10:48:01 GMT https://community.splunk.com/t5/Getting-Data-In/Can-I-use-the-collect-command-to-write-metrics-data-to-a-metrics/m-p/522219#M88182 andrewtrobec 2020-09-30T10:48:01Z https://community.splunk.com/t5/Getting-Data-In/Can-I-use-the-collect-command-to-write-metrics-data-to-a-metrics/m-p/522246#M88183 <P>The&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/7.3.2/SearchReference/Collect" target="_self">collect</A> command is used to send data to a&nbsp;<A href="https://docs.splunk.com/Splexicon:Summaryindex" target="_self">summary index</A>, not a metrics index.</P><P>Have a look at&nbsp;the <A href="https://docs.splunk.com/Documentation/Splunk/7.3.2/SearchReference/Mcollect" target="_self">mcollect</A> and <A href="https://docs.splunk.com/Documentation/Splunk/7.3.2/SearchReference/Meventcollect" target="_self">meventcollect</A> commands.&nbsp; They can be used to send event data to a metrics index.</P> Wed, 30 Sep 2020 12:43:19 GMT https://community.splunk.com/t5/Getting-Data-In/Can-I-use-the-collect-command-to-write-metrics-data-to-a-metrics/m-p/522246#M88183 ccl0utier 2020-09-30T12:43:19Z https://community.splunk.com/t5/Getting-Data-In/Can-I-use-the-collect-command-to-write-metrics-data-to-a-metrics/m-p/522256#M88185 <P>yeeeeeeeeeeeeeeeeeees!</P> Wed, 30 Sep 2020 13:05:26 GMT https://community.splunk.com/t5/Getting-Data-In/Can-I-use-the-collect-command-to-write-metrics-data-to-a-metrics/m-p/522256#M88185 andrewtrobec 2020-09-30T13:05:26Z