All Apps and Add-ons

Add-on Builder and Metric Indexes- Why aren't events showing up?

davidoff96
Path Finder

Hello,

I have to manipulate some data from an api, and send those events to splunk. One set of the api has to go to a normal index, but a subset of the data has to go to a metrics index, which is defined as an input in the add-on configuration.

 

However, when I try to send events to the metrics, I don't get anything showing up there. I have tried the following:

  • Prepending "metric_name:" to the field name for the metric
  • Making a new add-on to only send data to metrics (very simple create an event and send it)
  • In that same add-on, create the event, and send it to the index defined in the config, and defined my metrics index in that config

None of these worked. Is there a special way to send these to metrics indexes?

Labels (1)
Tags (4)
0 Karma
1 Solution

davidoff96
Path Finder

Alright - the issue was that the sourcetype for the metrics events had to have "INDEXED_EXTRACTIONS=json" in the props.conf. Once I had changed that, I was able to see those values in the metrics index.

View solution in original post

0 Karma

davidoff96
Path Finder

Alright - the issue was that the sourcetype for the metrics events had to have "INDEXED_EXTRACTIONS=json" in the props.conf. Once I had changed that, I was able to see those values in the metrics index.

0 Karma

johnhuang
Motivator

How are you ingesting the metrics? If you're using HEC, make sure you format it correctly and send it to the correct rest api endpoint url.

https://docs.splunk.com/Documentation/SplunkCloud/9.0.2208/Metrics/GetMetricsInOther 

0 Karma

davidoff96
Path Finder

This is through the add-on builder.  When I send the metric through to a normal index, it looks like this:

davidoff96_0-1665066001007.png

And my code for generating it looks like this:

data = {
'metric_name:tests_performed:testing': 4
}

event = helper.new_event(source=helper.get_input_type(), index='test-metrics', sourcetype=helper.get_sourcetype(), data=json.dumps(data))
ew.write_event(event)

 

Where index test-metrics is an index I have set up with the metrics type

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...