Getting Data In

Storing the correct host dimension with mcollect

JustinSC
Explorer

I've got some events I'm converting to metrics using mcollect with a scheduled report. Does anyone know how to get the metrics to store the original host from the logs instead of whichever indexer they get sent to?

This is the query I'm using to populate the metrics:

 

sourcetype=mysourcetype host=* "Events to count"
| bin _time span=1m
| stats count AS _value BY _time, host
| eval metric_name="My.Metric.Name"
| mcollect index="prod_metrics"

 

The host field in the metrics ends up being a random indexer from our cluster. I know I could always rename host as server, but if possible I'd like to use the expected field name since all our other natively populated metrics are by host.

Labels (1)
Tags (1)

andreasz
Path Finder

Same problem her.
Tried everything:

host=host

host=$host$

host={host}

...

 

 

0 Karma

JustinSC
Explorer

I never came up with a solution. I stopped using mcollect and now use the Summary Indexing feature with Metrics index type, which I believe requires Splunk 8.1.

For some reason I never setup any metrics to use a host dimension, but perhaps this feature preserves it. I believe something like this would work, or at least it's worth a shot:

sourcetype=mysourcetype host=* "Events to count"
| timechart limit=0 span=1m count by host
| untable _time host "My.Metric.Name"

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...