Getting Data In

Storing the correct host dimension with mcollect

JustinSC
Explorer

I've got some events I'm converting to metrics using mcollect with a scheduled report. Does anyone know how to get the metrics to store the original host from the logs instead of whichever indexer they get sent to?

This is the query I'm using to populate the metrics:

 

sourcetype=mysourcetype host=* "Events to count"
| bin _time span=1m
| stats count AS _value BY _time, host
| eval metric_name="My.Metric.Name"
| mcollect index="prod_metrics"

 

The host field in the metrics ends up being a random indexer from our cluster. I know I could always rename host as server, but if possible I'd like to use the expected field name since all our other natively populated metrics are by host.

Labels (1)
Tags (1)

andreasz
Path Finder

Same problem her.
Tried everything:

host=host

host=$host$

host={host}

...

 

 

0 Karma

JustinSC
Explorer

I never came up with a solution. I stopped using mcollect and now use the Summary Indexing feature with Metrics index type, which I believe requires Splunk 8.1.

For some reason I never setup any metrics to use a host dimension, but perhaps this feature preserves it. I believe something like this would work, or at least it's worth a shot:

sourcetype=mysourcetype host=* "Events to count"
| timechart limit=0 span=1m count by host
| untable _time host "My.Metric.Name"

 

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...