Splunk ITSI

Signalflow - retrieve multiple metrics at once?

dmoberg
Path Finder

I am trying to extract multiple metrics at once using a Signalflow query, but I am not sure if this is supported or just not undocumented. 

One metric works fine:
| sim flow query=" data('k8s.hpa.current_replicas', filter............"

Wildcard matching metrics works fine too:

| sim flow query=" data('k8s.hpa*', filter............"

But I have not been able to extract multiple named metrics (not wildcarded). Something like this (not working!!!):
| sim flow query=" data('k8s.hpa.current_replicas k8s.hpa.max_replicas', filter............"

 

Any ideas on how to get this to work?

Labels (1)
0 Karma
1 Solution

livehybrid
SplunkTrust
SplunkTrust

Hi @dmoberg 

You could define multiple metrics as their own streams such as:

livehybrid_0-1752484982705.png

 

|sim flow resolution=5000 query="A = data('demo.trans.count', rollup='rate').publish(label='A');B = data('demo.trans.latency', rollup='rate').publish(label='B')"
| chart latest(_value) over _time by sf_streamLabel

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

View solution in original post

0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @dmoberg 

You could define multiple metrics as their own streams such as:

livehybrid_0-1752484982705.png

 

|sim flow resolution=5000 query="A = data('demo.trans.count', rollup='rate').publish(label='A');B = data('demo.trans.latency', rollup='rate').publish(label='B')"
| chart latest(_value) over _time by sf_streamLabel

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma
Get Updates on the Splunk Community!

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...