All Apps and Add-ons

metric roll up naming convention

sistemistiposta
Path Finder

Hello,

I'm trying to roll up a metric index named <name>.
So I added a new index named <name>-rollup and I configured a metric-rollup.conf:

[index:<name>]
defaultAggregation = avg
dimensionList = cluster
dimensionListType = excluded
rollup.0.rollupIndex = <name>_rollup
rollup.0.span = 1d

Ok, it works, but quite useless for me. If I have an app which makes query like

| mstats avg(_value) as value where index= metric_name=system.load1 groupby metric_name, host span=1d
| eval {metric_name}=value

then I have to modify the query as
| mstats avg(_value) as value where index=_rollup metric_name=system.load1_mrollup_avg_86400s groupby metric_name, host span=1d
| eval {metric_name}=value

to work with summarized datas. This is a mess.
Is there a way to at least configure the naming convention of the new metric names?

Because if I can maintain the same metric name in the new index <name>_rollup I still can easily modify all the queries. Otherwise, I have to change all metric names and not only the index name!

Thank you very much
Kind Regards
Marco

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...