extracting values ​​from fields in metrics

[Be_JAR]

Hello.

I am working with opentelemetry metrics. I have a metric type index, and the format of the payload I receive is like this:

example payload :

{"deployment.environment":"entorno-pruebas","k8s.cluster.name":"splunk-otel","k8s.namespace.name":"default","k8s.node.name":"minikube","k8s.pod.name":"my-otel-demo-emailservice-fc5bc4c5f-jxzqz","k8s.pod.uid":"5fe1ada8-8baa-4960-b873-381b475b2b26","metric_type":"Gauge","os.type":"linux","metric_name:k8s.pod.filesystem.usage":491520}

I need a search that retrieves the various values ​​of the k8s.pod.name field. I'm trying different variations of the search, but I can't get it:

|mstats avg(_value) as VAL WHERE index=otel_k8s_metrics metric_name="metric_name:k8s.pod.filesystem.usage*"
|spath input=_raw path=k8s.pod.name output=k8s.pod.name
|stats values(k8s.pod.name) as k8s.pod.name
|table k8s.pod.name

Does anyone have any idea why it doesn't work. Metrics type indexes support spath

I appreciate any ideas

BR 

JAR

[KendallW]

Hi @Be_JAR  In your first screenshot, it looks like the k8s.pod.name field is already being extracted correctly? It seems to get extracted correctly when using this run-anywhere search using the payload you provided:

| makeresults
| eval _raw="{
  \"deployment.environment\":\"entorno-pruebas\",
  \"k8s.cluster.name\":\"splunk-otel\",
  \"k8s.namespace.name\":\"default\",
  \"k8s.node.name\":\"minikube\",
  \"k8s.pod.name\":\"my-otel-demo-emailservice-fc5bc4c5f-jxzqz\",
  \"k8s.pod.uid\":\"5fe1ada8-8baa-4960-b873-381b475b2b26\",
  \"metric_type\":\"Gauge\",
  \"os.type\":\"linux\",
  \"metric_name:k8s.pod.filesystem.usage\":491520
}"
| spath
| stats values(k8s.pod.name) as k8s.pod.name