Splunk Enterprise

Filter by tag in mstats

joergherzinger
Loves-to-Learn Lots

Hi,

I started using tags by tagging my hosts with the environment they are in and the service the host. Using these tags in log/event indices works perfectly well, but I am not able to filter by tags in mstats. I tried many variations of "WHERE tag=env.prod" or "WHERE "tag::host"="env.prod" but none return any results.
I checked that these tags really are there with mpreview which shows all the tags on the specific hosts and I also was able to filter with a small workaround using the tags command:

 

| mstats rate(os.unix.nmon.storage.diskread) AS read rate(os.unix.nmon.storage.diskwrite) AS write WHERE `my-metric-indizes` AND (host=*) BY host span=5m
| tags
| WHERE "service.vault" IN (tag) AND "env.prod" in (tag)
| stats sum(read) AS read, sum(write) AS write by _time,host
| timechart max(read) as read, max(write) as write bins=1000 by host

 

Is there a way to filter by a tag directly in mstats? The workaround is not very performance friendly...

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | What gets bigger the more you remove?

June 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...