Deployment Architecture

Help bucketing time with mcollect?

daniel333
Builder

all,

I am running this search to collect exceptions by host. I am bucketing into 1min intervals. However when I go back with mstats or the metrics work bench - data is being time stamped at the point of the summary job run rather than at the _time of the bucket itself.

tag=java host=mydc* priority=error OR priority=warning OR priority=fatal java_exception=* role=* host=*abc*
| rex field=host (?<pod>\w\w\w\w\d\d)
| bin _time span=1m 
| stats first(_time) as _time count by pod,role,java_exception, priority
| rename count as _value 
| eval metric_name="dpw3.toyrus.java.exceptions.count"
| mcollect index=testmetrics 

The results table LOOKS fine. But the final product has the wrong time.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...