Getting Data In

How can I keep an event AND get a metric at index time?

Builder

All,

I see a few examples on convert an event received into a metric. Is there a way to say keep an apache log and create a metric of the stratus?

thanks
-Daniel

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi,

You can convert existing event data into metric using mcollect command so in your case you need to schedule search which will run at regular interval and index data into metric index. Please refer documentation on https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Mcollect

Using this approach it will keep your apache logs in event index and it will ingest metric data in metric index, only drawback is you'll not able to see real-time data in metric event because it is purely depend on schedule search frequency.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Hi,

You can convert existing event data into metric using mcollect command so in your case you need to schedule search which will run at regular interval and index data into metric index. Please refer documentation on https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Mcollect

Using this approach it will keep your apache logs in event index and it will ingest metric data in metric index, only drawback is you'll not able to see real-time data in metric event because it is purely depend on schedule search frequency.

View solution in original post

0 Karma

Builder

Yeah, that might work. I'll talk to the customer to see if a 15 min backfill/delay is acceptable. Thanks for the reply!

0 Karma