Getting Data In

Discard metrics

giulioBalza
Path Finder

Hello to everyone,

i'm trying to figure out how to discard metrics before they are indexed. Unfortunately the source of the data cannot be configured to choose the right metrics, so We receive tons of unwanted metrics every 10 seconds.
For the events it is possible via props.conf and transforms.conf but I'm not able to find a way for the metrics.
I also checked the metric rollup policy however seems that acts on the indexed data (if I understood).
Anyone has faced this issue before ?

 

thanks,

G.

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...