Splunk Search

Using a "numeric" type rather than a "string" type is recommended to avoid indexing inefficiencies.

Explorer

got this error on the search head, Please help us to resolve this .Thanks

Search peer xxxxxx has the following
message: The metric
value=0.00003393234971117585 provided
for
source=/opt/splunkforwarder/var/log/splunk/metrics.log,
sourcetype=splunkmetricslog,
host=xxxxx, index=_metrics is not a
floating point value. Using a
"numeric" type rather than a "string"
type is recommended to avoid indexing
inefficiencies. Ensure the metric
value is provided as a floating point
number and not as a string. For
instance, provide 123.001 rather than
"123.001"

0 Karma

SplunkTrust
SplunkTrust

Splunk is telling you that somehow that metric is being created as a string rather than a number.

You may be able to simply use a conversion like this immediately before the mcollect command.

| eval foo = tonumber(foo) 

If that does not work, then please provide the portion of the search that creates the metric that holds that particular value.

0 Karma

Explorer

@daljeanis Thanks for the reply.But Im not sure which search is causing this problem.I verified all the searches which has metrics term used but none of them have index=_metrics .Do you have any idea where those are available.

0 Karma