Splunk Enterprise

using mcollect on contionous basis

Silah
Path Finder

Hi Folks

I've been using mcollect to collect metrics from the events in my indexes and I thought if I set up an alert with the mcollect part in the search, it would automatically collect the metrics every X minutes but that doesn't seem to be working, the metrics are only collected when I run the search manually.

 

Any suggestions to how I can make mcollect just automatically collect the metrics I am looking for ?

 

Thanks

Labels (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

If this is the only thing modifying your metrics index you could verify whether the data is not mcollected at all or just "mistimed".

Run

| mstats count(*) where index=<your_metrics_index>
| transpose 0
| stats sum("row 1") as total

over all-time before and after the scheduled search runs and verify the counts

View solution in original post

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Are you sure the user for which the search is scheduled has appropriate capabilities to run mcollect and access to the destination index?

0 Karma

Silah
Path Finder

I think so. I considered permissions and tried it in a lab setting as the admin user and it was the same result.

 

Besides, it works fine when the same user does it manually so I wouldn't have thought it would be any different for an automated one

0 Karma

PickleRick
SplunkTrust
SplunkTrust

If this is the only thing modifying your metrics index you could verify whether the data is not mcollected at all or just "mistimed".

Run

| mstats count(*) where index=<your_metrics_index>
| transpose 0
| stats sum("row 1") as total

over all-time before and after the scheduled search runs and verify the counts

0 Karma

Silah
Path Finder

I do feel a bit stupid now..

My Cron was wrong. The method was perfectly sane.

I did struggle to find any actual documentation to say that this was a way of doing it, so I hope this question will help future searchers determine that.

Thanks for helping my grey matter along

0 Karma
Get Updates on the Splunk Community!

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...

Use ‘em or lose ‘em | Splunk training units do expire

Whether it’s hummus, a ham sandwich, or a human, almost everything in this world has an expiration date. And, ...