- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi All,
I have a challenge, which i after many considerations have made a decision to, which indeed also have some consequences.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
As I’ve tried to explain right from the beginning, It has been metric date all the time, why the default defined (event) index name had to be changed to a metric index name, which now works as a charm on the HF, so it was all durable and works perfectly.
Thanks for all your input- they helped me to focus on the details here👍😊
All the best
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


One cannot redirect event data to a metrics index. Doing so will produce the error message you see. Data in a metrics index must be in a specific format - that is what makes them so fast. It is possible, however, to convert an event into metrics at index time. See https://docs.splunk.com/Documentation/SplunkCloud/9.3.2408/Metrics/L2MConfiguration
I must point out a fundamental flaw in the plan to have only two indexes for each customer. It means that all data will have the same retention period and (more seriously) all data will be visible to all users in that company. It's unlikely all of a company's data will have the same security and retention requirements.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @richgalloway,
Many thanks for your input.
I think there were a few things you got wrong here.
Let's begin from scratch here:
- The metrics are collected on Windows UF and sent via a HF to the final IDX.
- If the index name is defined (inputs.conf) in the collection app on the UF, and sent directly through the HF to the IDX, and works perfect.
- If NO index name is defined in above app, the UF default defined index will be used as destination, but here I have defined a props on the HF to "catch" sourcetypes containing 'metrics', and here convert (rename) the incoming (default) index name to its coresponding metric index name (aka from _e_ to _m_ type), and rename part works just fine, but something seems to happen to raw metrics data, as the indexer reject them now - THOUGH it's exactly the same data as in point 1. above.
About your last concern with two indexes, we have additional indexes if needed for different levels of data categories, BUT said that Spunk finaly works fine with search filters, so a lot can be handeled this way - but thanks for you great inputs her 🙂
- Everything works perfect when col
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


I got nothing wrong. Step 2 is not possible. Yes, you can change the name of the index, but an event cannot be written to a metric index without conversion. The fact that step 1 works perfectly tells me the data is an event rather than a metric.
Splunk has a tendency to overload terms. in this case, "metric" can refer to a numeric value in an event or it can refer to a specific format of data (also numeric) that only a metric index can store. it's the format (or lack of it) that's causing the error message.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
As I’ve tried to explain right from the beginning, It has been metric date all the time, why the default defined (event) index name had to be changed to a metric index name, which now works as a charm on the HF, so it was all durable and works perfectly.
Thanks for all your input- they helped me to focus on the details here👍😊
All the best
