I am trying to pull windows_TA perfmon data to a metric index to give our users sample data so they can create metric dashboards for their data before we move all the data to metric. I know I am close with the search, but missing something. I am only trying to get one type of event to work. I am doing spool=false so I can see the data, but when I remove this command I do not see the data in the metrics workspace.
Here is the basic search: index=perfmon host=test01* sourcetype="PerfmonMk:System" Here is the event data
ProcessorQueueLength = 0
SystemUpTime = 1639423.1988073
host = test01
source = PerfmonMk:System
sourcetype = PerfmonMk:System
Here is my mcollect search
index=perfmon host=test01* sourcetype="PerfmonMk:System"
| rename time as metrictimestamp, SystemUpTime as value
| eval metricname="SystemUpTime"
| table metrictimestamp, metricname, value, host
| mcollect index=perfmonmetric spool=false file=db-$timestamp$_metrics.csv host
Here is what I see in the spool var/run/splunk/metrics.csv file:
The top line is generated automatically