Dashboards & Visualizations

log to metrics sourcetype creation

MoniM
Communicator

Hi, i was trying to create a sourcetype for log to metrics data type but not getting what to put in measures section in metrics tab. My raw data contains _time, IP, Staus, Time, URL ? Can anyone tell me what fields need to be put as measures in this section?

Tags (1)

dauren_akilbeko
Communicator

I think you shouldn't convert this type of events to metrics. Metrics should have some numeric fields to be useful.

0 Karma

MoniM
Communicator

Okay, i got it the fields should be numeric, but in metrics tab while creating sourcetype i need to put all the field names. Am i getting it right?

0 Karma

dauren_akilbeko
Communicator

You could blacklist them.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...