Hi
I was reading this doc
https://docs.splunk.com/Documentation/Splunk/8.0.0/Metrics/GetMetricsInOther
at the end it says JSON data can now be brought into the Metrics index.
Can this be from a forwarder?
inputs.conf
[monitor:///net/mx12405vm/data/apps/qa10175_TPK0001304_34299998/logs.../.log]
disabled = false
host = TEST_AMBER_1234
index = amber_live_m
sourcetype = AMBER_METRIC_M
crcSalt =
whitelist = \w-\w*-\w*-\w*-\w*metrics.log$
blacklist=logs|fixing_|tps-archives
Props.conf
[AMBER_METRIC_M]
SHOULD_LINEMERGE = false
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N
TIME_PREFIX = \"ts\":\"
INDEXED_EXTRACTIONS = JSON
category = Metrics
{"v":"1.0","t":"MTR","ts":"2019-11-12T10:56:43.509Z","h":"mx12405vm","pid":26650,"src":{"c":"metrics","d":"performance","sd":"metrics"},"mtr":{"counters":{"process":{"cpu":{"time_cumulated_s":22},"memory":{"gc":{"ps_marksweep":{"total_duration_ms":229},"ps_scavenge":{"total_duration_ms":732}}}}},"gauges":{"process":{"cpu":{"percentage":0.0021161116902539325},"files":{"open_files":38},"memory":{"jvm":{"heap":{"committed_kb":174592,"used_kb":100703},"nonheap":{"committed_kb":73472,"used_kb":71934}},"vsz_kb":2281356}}},"histograms":{},"meters":{},"timers":{"process":{"memory":{"gc":{"ps_marksweep":{"events":{"count":0,"rate_1m":0.0,"rate_5m":0.0,"rate_15m":0.0,"rate_mean":0.0},"duration_ms":{"max":0.0,"mean":0.0,"median":0.0,"min":0.0,"percentile_75":0.0,"percentile_95":0.0,"percentile_98":0.0,"percentile_99":0.0,"percentile_999":0.0,"standard_deviation":0.0}},"ps_scavenge":{"events":{"count":27,"rate_1m":3.559899403082397,"rate_5m":4.968239838998346,"rate_15m":5.252064176428281,"rate_mean":0.7972358354858866},"duration_ms":{"max":34.0,"mean":10.370370370370372,"median":5.0,"min":3.0,"percentile_75":14.0,"percentile_95":31.199999999999985,"percentile_98":34.0,"percentile_99":34.0,"percentile_999":34.0,"standard_deviation":8.467803948114513}}}}}}}}
