I've configured a HEC to receive events from a Telegraf emitter, which provides metrics in the form:
{"time":1676415410,"event":"metric","host":"VaultNonProd-us-east-2a","index":"vault-metrics","fields":{"_value":0.022299762544379577,"cluster":"vault_nonprod","datacenter":"us-east-2","metric_name":"vault.raft.replication.heartbeat.NonProd-us-east-2b-d992bf60.stddev","metric_type":"timing","role":"vault-server"}}
All of the fields come across from the HF to our indexers except the one we're most interested, the _value field.
Searching around, I found https://docs.splunk.com/Documentation/DSP/1.3.1/Connection/IndexEvent which, in part, states that "Entries that are not included in fields include: any key that starts with underscore (such as _time)"
Is it possible to include an underscore-starting field in the forwarded event?
Thanks
OK, I feel like an idiot.
When collecting metrics, be sure to use a index of datatype 'metrics'