topic Re: Converting log events to metrics using existing fields in Getting Data In

Converting log events to metrics using existing fields

brent_weaver — Sun, 18 Nov 2018 13:05:50 GMT

Good morning all, I am reading docs on how to create sourcetypes for metrics but none go into how to just use fields instead of regex. I am using fluentbit to send metrics to HEC (and it works perfectly) in JSON format.

How do I use the existing fields to rewrite the sourcetype as metrics?

I included a screenshot of what the events look like.

Re: Converting log events to metrics using existing fields

jkat54 — Sun, 18 Nov 2018 14:44:06 GMT

Can’t you define the sourcetype when you setup the HEC token?

Would you want to change the sourcetype there?

There is a sourcetype rename feature in the settings drop down under fields I believe.

Re: Converting log events to metrics using existing fields

brent_weaver — Sun, 18 Nov 2018 16:52:03 GMT

When metrics are involved it's more than just defining the sourcetype. Standard fields need to be defined to play well with metrics store.

http://docs.splunk.com/Documentation/Splunk/7.2.1/Metrics/L2MOverview

Re: Converting log events to metrics using existing fields

jkat54 — Sun, 18 Nov 2018 18:54:48 GMT

Ok so you don’t want to “rewrite the sourcetype as metrics”...

This was somewhere on the link you gave, does it make sense?

http://docs.splunk.com/Documentation/Splunk/7.2.1/Metrics/L2MConfiguration