Splunk IT Service Intelligence

Several Metrics value errors

seanjconnell
Explorer

We recently implemented Metrics indices to support ITSI in our environment. I am receiving multiple messages that I am not getting a clear understanding on Splunk Answers.

Here are a Few of the messages I am receiving, I hope most are related.

*Search peer Indexer1 has the following message: The metric value 1234.56789 provided for source=5555 (udp port for collectd), sourcetype=em_metrics_udp, host=client2 index=linuxmetrics is not a floating point value. Using a "numberic" type rather than a "string" type is recommended to avoid indexing inefficiencies. Ensure the metric value is provided as a floating point number as not as a string. For instance, provid 123.001 rather than "123.001". *

Search peer Indexer1 has the following message: Metric value= is not valid for source=DNS, sourcetype=DNS, host=Client1 index=winmetrics. Metric event data with an invalid metric value would not be indexed. Ensure the input metric data is not malformed.

*Search peer Indexer1 has the following message: Metric name is missing for source=Replicated_Folders sourcetype=Replicated_folders, host=client3, index=winmetrics. Metric event data without a metric name is invalid and would not be indexed. Ensure the input metric data is not malformed. *

bbenjamin_splun
Splunk Employee
Splunk Employee

@seanjconnell is this question in regards to Splunk App for Infrastructure? are these error messages caused by metrics collected by collectd?

seanjconnell
Explorer

@bbenjamin, The linux error is definetly being caused by collectd, but the other two seem to be errors caused by SAI implementation done by Professional services and or metrics indexes

0 Karma

bbenjamin_splun
Splunk Employee
Splunk Employee

@seanjconnell Although I saw the same linux error in my local testing, I have not been able to replicate the issue consistently - it occurred just couple times in several hours. I'm guessing those UDP messages got corrupted somehow. I'm however able to see the dashboards for the said metric in SAI (in the case of linux, these are just warning messages and shouldn't really cause data loss). If these messages are popping up in large numbers, I'd reach out to whoever set this up for you to check all the configurations.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...