Splunk ITSI

ITSI: collectd adding .value to metrics name

tedlasso
New Member

Howdy

Trying to figure out a problem. We're using collectd on a Centos el7 box using the default configuration for the cpu plugin. Metrics are making it into Splunk with no problems. When looking at an entity, it shows no data on the graphs. Looking at the query for cpu, I see the fields like cpu.system and cpu.user. Looking at the metrics, I see cpu.system.value and cpu.user.value. Changing the query to use those fields with .value generates results and pretty graphs. Splunk docs specifically mention support collectd so I must be missing something? Do I need to further tweak collectd conf? Or do I need to tweak all the queries to use <metrics name>.value?

Thanks!

Labels (1)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...