Getting Data In

Metric Store

wilhelmF
Path Finder

I have many log files that look like the one below. The first one is the unix time in milliseconds. The second one is the dimension and the third and fourth are the metrics I would like to store in a metrics-index.

So my questoin is how do I need to change the config files in order to save this data in a metric store?

date,type,price,amount
1440720037000,b,201.49,0.1
1440720037000,b,201.48,0.1
1440720037000,b,201.08,6.539
1440720037000,b,200.98132,0.8
1440720037000,b,200.95858,11.031
1440720037000,b,200.87032,0.01
1440720037000,b,200.77788,10.354
1440720037000,b,200.77,0.1
1440720037000,b,200.59735,10.366
Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

See the Metrics manual (http://docs.splunk.com/Documentation/Splunk/7.0.1/Metrics/GetMetricsInOther) for a description of the expected format of metrics inputs.

---
If this reply helps you, Karma would be appreciated.

wilhelmF
Path Finder

Yes I saw this, but the question is how can I create two events from one line as the metric entry only allows one numerical value. Or I am getting it wrong? That's why I am asking for specific config. Thanks

0 Karma

bsonposh
Communicator

As Rich stated... you cannot do what you want. I've fought this for months 🙂

Your best bet is using JSON via HEC but if you want to use CSV you will need 1 line for each metric in the format specified in the doc.

richgalloway
SplunkTrust
SplunkTrust

The format of a metric index is fixed. Your data must be in that format. If you can't make your data fit the established schema then you'll have to use an event index.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...