Dashboards & Visualizations

log to metrics sourcetype creation

MoniM
Communicator

Hi, i was trying to create a sourcetype for log to metrics data type but not getting what to put in measures section in metrics tab. My raw data contains _time, IP, Staus, Time, URL ? Can anyone tell me what fields need to be put as measures in this section?

Tags (1)

dauren_akilbeko
Communicator

I think you shouldn't convert this type of events to metrics. Metrics should have some numeric fields to be useful.

0 Karma

MoniM
Communicator

Okay, i got it the fields should be numeric, but in metrics tab while creating sourcetype i need to put all the field names. Am i getting it right?

0 Karma

dauren_akilbeko
Communicator

You could blacklist them.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...