Several Metrics value errors

[seanjconnell]

We recently implemented Metrics indices to support ITSI in our environment. I am receiving multiple messages that I am not getting a clear understanding on Splunk Answers.

Here are a Few of the messages I am receiving, I hope most are related.

*Search peer Indexer1 has the following message: The metric value 1234.56789 provided for source=5555 (udp port for collectd), sourcetype=em_metrics_udp, host=client2 index=linuxmetrics is not a floating point value. Using a "numberic" type rather than a "string" type is recommended to avoid indexing inefficiencies. Ensure the metric value is provided as a floating point number as not as a string. For instance, provid 123.001 rather than "123.001". *

Search peer Indexer1 has the following message: Metric value= is not valid for source=DNS, sourcetype=DNS, host=Client1 index=winmetrics. Metric event data with an invalid metric value would not be indexed. Ensure the input metric data is not malformed.

*Search peer Indexer1 has the following message: Metric name is missing for source=Replicated_Folders sourcetype=Replicated_folders, host=client3, index=winmetrics. Metric event data without a metric name is invalid and would not be indexed. Ensure the input metric data is not malformed. *

[bbenjamin_splun]

@seanjconnell is this question in regards to Splunk App for Infrastructure? are these error messages caused by metrics collected by collectd?

[seanjconnell]

@bbenjamin, The linux error is definetly being caused by collectd, but the other two seem to be errors caused by SAI implementation done by Professional services and or metrics indexes

[bbenjamin_splun]

@seanjconnell Although I saw the same linux error in my local testing, I have not been able to replicate the issue consistently - it occurred just couple times in several hours. I'm guessing those UDP messages got corrupted somehow. I'm however able to see the dashboards for the said metric in SAI (in the case of linux, these are just warning messages and shouldn't really cause data loss). If these messages are popping up in large numbers, I'd reach out to whoever set this up for you to check all the configurations.