Splunk ITSI

Signalflow - retrieve multiple metrics at once?

dmoberg
Path Finder

I am trying to extract multiple metrics at once using a Signalflow query, but I am not sure if this is supported or just not undocumented. 

One metric works fine:
| sim flow query=" data('k8s.hpa.current_replicas', filter............"

Wildcard matching metrics works fine too:

| sim flow query=" data('k8s.hpa*', filter............"

But I have not been able to extract multiple named metrics (not wildcarded). Something like this (not working!!!):
| sim flow query=" data('k8s.hpa.current_replicas k8s.hpa.max_replicas', filter............"

 

Any ideas on how to get this to work?

Labels (1)
0 Karma
1 Solution

livehybrid
SplunkTrust
SplunkTrust

Hi @dmoberg 

You could define multiple metrics as their own streams such as:

livehybrid_0-1752484982705.png

 

|sim flow resolution=5000 query="A = data('demo.trans.count', rollup='rate').publish(label='A');B = data('demo.trans.latency', rollup='rate').publish(label='B')"
| chart latest(_value) over _time by sf_streamLabel

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

View solution in original post

0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @dmoberg 

You could define multiple metrics as their own streams such as:

livehybrid_0-1752484982705.png

 

|sim flow resolution=5000 query="A = data('demo.trans.count', rollup='rate').publish(label='A');B = data('demo.trans.latency', rollup='rate').publish(label='B')"
| chart latest(_value) over _time by sf_streamLabel

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...