All Apps and Add-ons

Add-on Builder and Metric Indexes- Why aren't events showing up?

davidoff96
Path Finder

Hello,

I have to manipulate some data from an api, and send those events to splunk. One set of the api has to go to a normal index, but a subset of the data has to go to a metrics index, which is defined as an input in the add-on configuration.

 

However, when I try to send events to the metrics, I don't get anything showing up there. I have tried the following:

  • Prepending "metric_name:" to the field name for the metric
  • Making a new add-on to only send data to metrics (very simple create an event and send it)
  • In that same add-on, create the event, and send it to the index defined in the config, and defined my metrics index in that config

None of these worked. Is there a special way to send these to metrics indexes?

Labels (1)
Tags (4)
0 Karma
1 Solution

davidoff96
Path Finder

Alright - the issue was that the sourcetype for the metrics events had to have "INDEXED_EXTRACTIONS=json" in the props.conf. Once I had changed that, I was able to see those values in the metrics index.

View solution in original post

0 Karma

davidoff96
Path Finder

Alright - the issue was that the sourcetype for the metrics events had to have "INDEXED_EXTRACTIONS=json" in the props.conf. Once I had changed that, I was able to see those values in the metrics index.

0 Karma

johnhuang
Motivator

How are you ingesting the metrics? If you're using HEC, make sure you format it correctly and send it to the correct rest api endpoint url.

https://docs.splunk.com/Documentation/SplunkCloud/9.0.2208/Metrics/GetMetricsInOther 

0 Karma

davidoff96
Path Finder

This is through the add-on builder.  When I send the metric through to a normal index, it looks like this:

davidoff96_0-1665066001007.png

And my code for generating it looks like this:

data = {
'metric_name:tests_performed:testing': 4
}

event = helper.new_event(source=helper.get_input_type(), index='test-metrics', sourcetype=helper.get_sourcetype(), data=json.dumps(data))
ew.write_event(event)

 

Where index test-metrics is an index I have set up with the metrics type

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...