The PingDirectory App documentation states to use log2metrics_json as the sourcetype. The onprem Splunk v9.0 does not have this as a pretrained sourcetype. Need to get ping metrics logs from dsstats.json and I have created a metrics index and receive the following error when using the log2metrics_json sourcetype.
"....The metric event is not properly structured, source=/ping/latest/logs/dsstats.json, sourcetype=log2metrics_json, host=pdir0001, index=pdmetrics. Metric event data without a metric name and properly formated numerical values are invalid and cannot be indexed. Ensure the input metric data is not malformed....."
It appears that Splunk Cloud has the log2metrics_json sourcetype. If so, what are the configs needed for props and transforms needed to duplicate this?
