Splunk Search

Converting events data into metric using Mcollect

ssharma09
Explorer

Hi Guys,

I'm trying to convert events data into metric for CPU, Disk, Memory monitoring for Azure PAAS, using below command.
index=azure_data metric_name=cpu_percent
| eval metric_name=case(metric_name="cpu_percent", "%_Processor_Time")| eval _value=maximum
| fields host,metric_name,namespace,_time,_value
| eval prefix="Processor." | mcollect index=azure_metrics_summary prefix_field=prefix

*here I'm trying to use mcollect to send CPU data to summary index "azure_metrics_summary ". Query is running with no error but not showing _value field in the output and when I'm running below command to search metrics data , Not seeing any output.

| mstats avg(_value) count where metric_name="Processor.%_Processor_Time" index=azure_metrics_summary by host

Tags (1)
0 Karma

gjanders
SplunkTrust
SplunkTrust

Did you try using the metric explorer or analytics workspace to see if you can find the said metrics?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...