Splunk Search

sending events from input based on regex to metrics

Contributor

I have created a setup where from an input based on a regex some of the events are sent to a specific index with changed source type. It is working nicely with regular indexes, but I can not get it working with metrics based indexes. What could be wrong?

props.conf
[csv]
TRANSFORMS-indst = changeindex,changesourcetype

inputs.conf
[udp://514]
connection_host = ip
sourcetype = csv

transforms.conf
[changeindex]
REGEX = (?i) error
DEST
KEY = MetaData:Index
WRITE
META = true
FORMAT = metrics_index

[changesourcetype]
REGEX = (?i) error
DEST
KEY = MetaData:
WRITE
META = true
DESTKEY = MetaData:Sourcetype
FORMAT = sourcetype::metrics
sourcetype

0 Karma

SplunkTrust
SplunkTrust

Hi @imrago,

the sourcetype csv already has a lot of predefined configurations that are probably overwritting whatever you are trying to do there. Change a your sourcetype's name and you should be okay 😉

Cheers,
David

0 Karma

SplunkTrust
SplunkTrust

What are the fields available in your CSV file?? See this Splunk documentation for what format Splunk expects it: https://docs.splunk.com/Documentation/Splunk/7.2.6/Metrics/GetMetricsInOther

0 Karma

Contributor

used csv just an example, when I send directly to a metrics index then everything is working fine

0 Karma