Getting Data In

Assistance on mcollect command for perfmon

dsbruce
Explorer

I am trying to pull windows_TA perfmon data to a metric index to give our users sample data so they can create metric dashboards for their data before we move all the data to metric. I know I am close with the search, but missing something. I am only trying to get one type of event to work. I am doing spool=false so I can see the data, but when I remove this command I do not see the data in the metrics workspace.

Here is the basic search: index=perfmon host=test01* sourcetype="PerfmonMk:System"
Here is the event data
Processor_Queue_Length = 0
System_Up_Time = 1639423.1988073
host = test01
source = PerfmonMk:System
sourcetype = PerfmonMk:System

Here is my mcollect search
index=perfmon host=test01* sourcetype="PerfmonMk:System"
| rename _time as metric_timestamp, System_Up_Time as _value
| eval metric_name="System_Up_Time"
| table metric_timestamp, metric_name, _value, host
| mcollect index=perfmon_metric spool=false file=db-$timestamp$_metrics.csv host

Here is what I see in the spool var/run/splunk/metrics.csv file:
The top line is generated automatically

metric_timestamp,metric_name,_value,host
1578588112.000,System_Up_Time,1642783.1900182,test01

Any assistance would be appreciated.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...