Hello.
I am working with opentelemetry metrics. I have a metric type index, and the format of the payload I receive is like this:
example payload :
{"deployment.environment":"entorno-pruebas","k8s.cluster.name":"splunk-otel","k8s.namespace.name":"default","k8s.node.name":"minikube","k8s.pod.name":"my-otel-demo-emailservice-fc5bc4c5f-jxzqz","k8s.pod.uid":"5fe1ada8-8baa-4960-b873-381b475b2b26","metric_type":"Gauge","os.type":"linux","metric_name:k8s.pod.filesystem.usage":491520}
I need a search that retrieves the various values of the k8s.pod.name field. I'm trying different variations of the search, but I can't get it:
|mstats avg(_value) as VAL WHERE index=otel_k8s_metrics metric_name="metric_name:k8s.pod.filesystem.usage*"
|spath input=_raw path=k8s.pod.name output=k8s.pod.name
|stats values(k8s.pod.name) as k8s.pod.name
|table k8s.pod.name
Does anyone have any idea why it doesn't work. Metrics type indexes support spath
I appreciate any ideas
BR
JAR
Hi @Be_JAR In your first screenshot, it looks like the k8s.pod.name field is already being extracted correctly? It seems to get extracted correctly when using this run-anywhere search using the payload you provided:
| makeresults
| eval _raw="{
\"deployment.environment\":\"entorno-pruebas\",
\"k8s.cluster.name\":\"splunk-otel\",
\"k8s.namespace.name\":\"default\",
\"k8s.node.name\":\"minikube\",
\"k8s.pod.name\":\"my-otel-demo-emailservice-fc5bc4c5f-jxzqz\",
\"k8s.pod.uid\":\"5fe1ada8-8baa-4960-b873-381b475b2b26\",
\"metric_type\":\"Gauge\",
\"os.type\":\"linux\",
\"metric_name:k8s.pod.filesystem.usage\":491520
}"
| spath
| stats values(k8s.pod.name) as k8s.pod.name