Splunk ITSI

Signalflow - retrieve multiple metrics at once?

dmoberg
Path Finder

I am trying to extract multiple metrics at once using a Signalflow query, but I am not sure if this is supported or just not undocumented. 

One metric works fine:
| sim flow query=" data('k8s.hpa.current_replicas', filter............"

Wildcard matching metrics works fine too:

| sim flow query=" data('k8s.hpa*', filter............"

But I have not been able to extract multiple named metrics (not wildcarded). Something like this (not working!!!):
| sim flow query=" data('k8s.hpa.current_replicas k8s.hpa.max_replicas', filter............"

 

Any ideas on how to get this to work?

Labels (1)
0 Karma
1 Solution

livehybrid
SplunkTrust
SplunkTrust

Hi @dmoberg 

You could define multiple metrics as their own streams such as:

livehybrid_0-1752484982705.png

 

|sim flow resolution=5000 query="A = data('demo.trans.count', rollup='rate').publish(label='A');B = data('demo.trans.latency', rollup='rate').publish(label='B')"
| chart latest(_value) over _time by sf_streamLabel

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

View solution in original post

0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @dmoberg 

You could define multiple metrics as their own streams such as:

livehybrid_0-1752484982705.png

 

|sim flow resolution=5000 query="A = data('demo.trans.count', rollup='rate').publish(label='A');B = data('demo.trans.latency', rollup='rate').publish(label='B')"
| chart latest(_value) over _time by sf_streamLabel

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...